rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-6328 
Directory traversal vulnerability in index.php for TorrentFlux 2.2 allows remote attackers to create or overwrite arbitrary files via sequences in the alias_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-06T21:00:00.000Z
CVE-2006-6329 
index.php for TorrentFlux 2.2 allows remote attackers to delete files by specifying the target filename in the delfile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-06T21:00:00.000Z
CVE-2006-6330 
index.php for TorrentFlux 2.2 allows remote registered users to execute arbitrary commands via shell metacharacters in the kill parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-06T21:00:00.000Z
CVE-2006-6331 
metaInfo.php in TorrentFlux 2.2, when $cfg["enable_file_priority"] is false, allows remote attackers to execute arbitrary commands via shell metacharacters (backticks) in the torrent parameter to (1) details.php and (2) startpop.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-06T21:00:00.000Z
CVE-2006-6332 
Stack-based buffer overflow in net80211/ieee80211_wireless.c in MadWifi before 0.9.2.1 allows remote attackers to execute arbitrary code via unspecified vectors, related to the encode_ie and giwscan_cb functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-10T11:00:00.000Z
CVE-2006-6333 
The tr_rx function in ibmtr.c for Linux kernel 2.6.19 assigns the wrong flag to the ip_summed field, which allows remote attackers to cause a denial of service (memory corruption) via crafted packets that cause the kernel to interpret another field as an offset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-06T22:00:00.000Z
CVE-2006-6334 
Heap-based buffer overflow in the SendChannelData function in wfica.ocx in Citrix Presentation Server Client before 9.230 for Windows allows remote malicious web sites to execute arbitrary code via a DataSize parameter that is less than the length of the Data buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-08T01:00:00.000Z
CVE-2006-6335 
Multiple buffer overflows in Sophos Anti-Virus scanning engine before 2.40 allow remote attackers to execute arbitrary code via (1) a SIT archive with a long filename that is not null-terminated, which triggers a heap-based overflow in veex.dll due to improper length calculation, and (2) a CPIO archive, with a long filename that is not null-terminated, which triggers a stack-based overflow in veex.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-12T20:00:00.000Z
CVE-2006-6336 
Heap-based buffer overflow in the Mail Management Server (MAILMA.exe) in Eudora WorldMail 3.1.x allows remote attackers to execute arbitrary code via a crafted request containing successive delimiters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T00:00:00.000Z
CVE-2006-6337 
Multiple SQL injection vulnerabilities in giris.asp in Aspee and Dogantepe Ziyaretci Defteri allow remote attackers to execute arbitrary SQL commands via the (1) kullanici or (2) parola parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6338 
Unrestricted file upload vulnerability in upload/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to upload and execute arbitrary .php files by embedding PHP code in a JPEG or GIF file that is uploaded to inc/images/uploads/userpics/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6339 
SQL injection vulnerability in sites/index.php in deV!L`z Clanportal (DZCP) before 1.3.6.1 allows remote attackers to execute arbitrary SQL commands via the show element in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6340 
keystone.exe in nVIDIA nView allows attackers to cause a denial of service via a long command line argument.  NOTE: it is not clear whether this issue crosses security boundaries. If not, then this is not a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6341 
Multiple PHP remote file inclusion vulnerabilities in mg.applanix 1.3.1 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the apx_root_path parameter to (1) act/act_check_access.php, (2) dsp/dsp_form_booking_ctl.php, and (3) dsp/dsp_bookings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6342 
Multiple SQL injection vulnerabilities in KLF-DESIGN (aka Kim L. Fraser) KLF-REALTY allow remote attackers to execute arbitrary SQL commands via the (1) category and (2) agent parameters in (a) search_listing.asp, and the (3) property_id parameter in (b) detail.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6343 
SQL injection vulnerability in polls.php in Neocrome Seditio 1.10 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6344 
Multiple unspecified vulnerabilities in Neocrome Seditio 1.10 and earlier have unknown impact and attack vectors related to (1) plugins/ipsearch/ipsearch.admin.php, and (2) pfs/pfs.edit.inc.php, (3) users/users.register.inc.php in system/core.  NOTE: the users.profile.inc.php vector is identified by CVE-2006-6177.  NOTE: these issues might be related to SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6345 
Directory traversal vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 16 and earlier, and 7.00 Patchlevel 6 and earlier, allows remote attackers to delete arbitrary files via directory traversal sequences in an HTTP request.  NOTE: This information is based upon an initial disclosure. Details will be updated after the grace period has ended. This issue is different from CVE-2006-4133 and CVE-2006-4134.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6346 
Unspecified vulnerability in SAP Internet Graphics Service (IGS) 6.40 Patchlevel 15 and earlier, and 7.00 Patchlevel 3 and earlier, allows remote attackers to cause a denial of service (service shutdown), obtain sensitive information (configuration files), and conduct certain other unauthorized activities, related to "Undocumented Features." NOTE: it is possible that there are multiple issues. This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. This is likely a different issue than CVE-2006-4134.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6347 
Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files, possibly using admin/index.php.  NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6348 
Cross-site scripting (XSS) vulnerability in board.php in mowdBB RC-6 allows remote attackers to inject arbitrary web script or HTML via the forum_name[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6349 
Multiple SQL injection vulnerabilities in PWP Technologies The Classified Ad System allow remote attackers to execute arbitrary SQL commands via (1) the main parameter in a view action (includes/mainpage/view.asp) in default.asp or (2) a query in the search engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6350 
listpics 5 stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for listpics.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6351 
KhaledMuratList stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) CL2F9R1A2C1N.mdb or (2) Data2F9R1A2C1N.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6352 
FRISK Software F-Prot Antivirus before 4.6.7 allows user-assisted remote attackers to cause a denial of service (infinite loop) via a crafted ACE file.  NOTE: this issue has at least a partial overlap with CVE-2006-6294.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6353 
Multiple unspecified vulnerabilities in BOMArchiveHelper in Mac OS X allow user-assisted remote attackers to cause a denial of service (application crash) via unspecified vectors related to (1) certain KERN_PROTECTION_FAILURE thread crashes and (2) certain KERN_INVALID_ADDRESS thread crashes, as discovered with the "iSec Partners FileP fuzzer".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6354 
Multiple SQL injection vulnerabilities in detail.asp in DuWare DuNews allow remote attackers to execute arbitrary SQL commands via the (1) iNews, (2) iType, or (3) Action parameter.  NOTE: the iType parameter in type.asp is covered by CVE-2005-3976.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6355 
SQL injection vulnerability in default.asp in DuWare DuClassmate allows remote attackers to execute arbitrary SQL commands via the iCity parameter.  NOTE: the iState parameter is already covered by CVE-2005-2049.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6356 
Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) id, (3) subject, (4) username, or (5) time parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6357 
Cross-site scripting (XSS) vulnerability in templates/cat_temp.php in PHPNews 1.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T01:00:00.000Z
CVE-2006-6358 
SQL injection vulnerability in the login function in auth.inc in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to execute arbitrary SQL commands via the (1) username and possibly the (2) password parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6359 
Cross-site scripting (XSS) vulnerability in Stefan Frech online-bookmarks 0.6.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6360 
PHP remote file inclusion vulnerability in activate.php in PHP Upload Center 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the footerpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6361 
Heap-based buffer overflow in the uploadprogress_php_rfc1867_file function in uploadprogress.c in Bitflux Upload Progress Meter before 8276 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via crafted HTTP POST fileupload requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6363 
Cross-site scripting (XSS) vulnerability in admin.pl in BlueSocket Secure Controller (BSC) before 5.2, or without 5.1.1-BluePatch, allows remote attackers to inject arbitrary web script or HTML via the ad_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6364 
Cross-site scripting (XSS) vulnerability in error.php in Inside Systems Mail (ISMail) 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6365 
SQL injection vulnerability in detail.asp in DUware DUpaypal 3.1, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the iType parameter.  NOTE: the iState parameter is already covered by CVE-2005-3976 and the iPro parameter is already covered by CVE-2005-2047.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6366 
Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php in Cerberus Helpdesk 0.97.3, 2.0 through 2.7, 3.2.1, and 3.3 allows remote attackers to inject arbitrary web script or HTML via the js parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6367 
Multiple SQL injection vulnerabilities in detail.asp in DUware DUdownload 1.1, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the (1) iFile or (2) action parameter.  NOTE: the iType parameter is already covered by CVE-2005-3976.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6368 
PHP remote file inclusion vulnerability in login.php.inc in awrate 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T11:00:00.000Z
CVE-2006-6369 
SQL injection vulnerability in lib/entry_reply_entry.php in Invision Community Blog Mod 1.2.4 allows remote attackers to execute arbitrary SQL commands via the eid parameter, when accessed through the "Preview message" functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6370 
SQL injection vulnerability in forum/modules/gallery/post.php in Invision Gallery 2.0.7 allows remote attackers to cause a denial of service and possibly have other impacts, as demonstrated using a "SELECT BENCHMARK" statement in the img parameter in a doaddcomment operation in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6371 
Cross-site scripting (XSS) vulnerability in pbguestbook.php in JAB Guest Book allows remote attackers to inject arbitrary web script or HTML via the author parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6372 
Multiple cross-site scripting (XSS) vulnerabilities in pbguestbook.php in JAB Guest Book 20061205 allow remote attackers to inject arbitrary web script or HTML via the (1) topic or (2) message parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6373 
PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensitive information via a direct request for libraries/common.lib.php, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6374 
Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-pl2 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a phpMyAdmin cookie in (1) css/phpmyadmin.css.php, (2) db_create.php, (3) index.php, (4) left.php, (5) libraries/session.inc.php, (6) libraries/transformations/overview.php, (7) querywindow.php, (8) server_engines.php, and possibly other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6375 
Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer's automatic type detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6376 
Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use ".." sequences to (1) read arbitrary files via the filename parameter in a download action, (2) delete arbitrary files via the delete parameter, and (3) modify arbitrary files via the edit parameter, which can be leveraged to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6377 
Uploadscript 1.2 and earlier stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain the admin password hash via a direct request for /password.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6378 
BTSaveMySql 1.2 stores sensitive data under the web root with insufficient access control, which allows remote attackers to obtain configuration and save files via direct requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T17:00:00.000Z
CVE-2006-6379 
Buffer overflow in the BrightStor Backup Discovery Service in multiple CA products, including ARCserve Backup r11.5 SP1 and earlier, ARCserve Backup 9.01 up to 11.1, Enterprise Backup 10.5, and CA Server Protection Suite r2, allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-10T19:00:00.000Z
CVE-2006-6380 
Cross-site scripting (XSS) vulnerability in index.asp in Ultimate HelpDesk allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T21:00:00.000Z
CVE-2006-6381 
Directory traversal vulnerability in getfile.asp in Ultimate HelpDesk allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T21:00:00.000Z
CVE-2006-6382 
The control panel for Positive Software H-Sphere before 2.5.0 RC3 creates log files in a user's directory with insecure permissions, which allows local users to append log data to arbitrary files via a symlink attack.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T21:00:00.000Z
CVE-2006-6383 
PHP 5.2.0 and 4.4 allows local users to bypass safe_mode and open_basedir restrictions via a malicious path and a null byte before a ";" in a session_save_path argument, followed by an allowed path, which causes a parsing inconsistency in which PHP validates the allowed path but sets session.save_path to the malicious path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-10T20:00:00.000Z
CVE-2006-6384 
Absolute path traversal vulnerability in abitwhizzy.php before 20061204 allows remote attackers to read arbitrary files via an absolute pathname in the Filename text window (f parameter), a variant of CVE-2006-6084.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-07T23:00:00.000Z
CVE-2006-6385 
Stack-based buffer overflow in Intel PRO 10/100, PRO/1000, and PRO/10GbE PCI, PCI-X, and PCIe network adapter drivers (aka NDIS miniport drivers) before 20061205 allows local users to execute arbitrary code with "kernel-level" privileges via an incorrect function call in certain OID handlers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-08T01:00:00.000Z
CVE-2006-6386 
Cross-site scripting (XSS) vulnerability in the CVS management/tracker 4.7.x-1.0, 4.7.x-2.0, and 4.7.0 (before the 20060807 contribution release system) for Drupal allows remote attackers to inject arbitrary web script or HTML via the motivation field in the CVS application page, which is not passed through check_markup on display.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-08T01:00:00.000Z
CVE-2006-6387 
Multiple SQL injection vulnerabilities in LINK Content Management Server (CMS) allow remote attackers to execute arbitrary SQL commands via the (1) IDMeniGlavni parameter to navigacija.php, and the (2) IDStranicaPodaci parameter to prikazInformacije.php.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-08T01:00:00.000Z
CVE-2006-6388 
Cross-site scripting (XSS) vulnerability in naprednaPretraga.php in LINK Content Management Server (CMS) allows remote attackers to inject arbitrary web script or HTML via the txtPretraga parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-08T01:00:00.000Z
CVE-2006-6389 
Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via the (1) Taaa parameter to (a) up.php, or the (2) pollhtml and (3) Bloks parameters to (b) polls.php, different vectors than CVE-2006-5770.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-08T01:00:00.000Z
CVE-2006-6390 
Multiple directory traversal vulnerabilities in Open Solution Quick.Cart 2.0, when register_globals is enabled and magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the config[db_type] parameter to (1) categories.php, (2) couriers.php, (3) orders.php, and (4) products.php in actions_admin/; and (5) orders.php and (6) products.php in actions_client/; as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by one of these PHP scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-08T01:00:00.000Z