rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-3732 
In Linux 2.6 before 2.6.23, the TRACE_IRQS_ON function in iret_exc calls a C function without ensuring that the segments are set properly. The kernel's %fs needs to be restored before the call in TRACE_IRQS_ON and before enabling interrupts, so that "current" references work. Without this, "current" used in the window between iret_exc and the middle of error_code where %fs is reset, would crash.
Problem types: description: Reset %fs early in iret_exc
Affected products: vendor: linux-2.6
product: linux-2.6
Published: 2019-11-07T21:31:50.000Z
CVE-2007-3734 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5 allow remote attackers to cause a denial of service (crash) via unspecified vectors that trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3735 
Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 2.0.0.5 and Thunderbird before 2.0.0.5 allow remote attackers to cause a denial of service (crash) via unspecified vectors that trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3736 
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0.0.5 allows remote attackers to inject arbitrary web script "into another site's context" via a "timing issue" involving the (1) addEventListener or (2) setTimeout function, probably by setting events that activate after the context has changed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3737 
Mozilla Firefox before 2.0.0.5 allows remote attackers to execute arbitrary code with chrome privileges by calling an event handler from an unspecified "element outside of a document."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3738 
Multiple unspecified vulnerabilities in Mozilla Firefox before 2.0.0.5 allow remote attackers to execute arbitrary code via a crafted XPCNativeWrapper.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3739 
mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service (OOPS) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-14T01:00:00.000Z
CVE-2007-3740 
The CIFS filesystem in the Linux kernel before 2.6.22, when Unix extension support is enabled, does not honor the umask of a process, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-14T01:00:00.000Z
CVE-2007-3741 
The (1) psp (aka .tub), (2) bmp, (3) pcx, and (4) psd plugins in gimp allow user-assisted remote attackers to cause a denial of service (crash or memory consumption) via crafted image files, as discovered using the fusil fuzzing tool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-27T17:00:00.000Z
CVE-2007-3742 
WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-3743 
Stack-based buffer overflow in bookmark handling in Apple Safari 3 Beta before Update 3.0.3 on Windows allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a bookmark with a long title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T20:00:00.000Z
CVE-2007-3744 
Heap-based buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in mDNSResponder on Apple Mac OS X 10.4.10 before 20070731 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-3745 
The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 contains an unsafe interface that is exposed by JDirect, which allows remote attackers to free arbitrary memory and thereby execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-3746 
The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not properly check the bounds of heap read and write operations, which allows remote attackers to execute arbitrary code via a crafted applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-3747 
The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not restrict object instantiation and manipulation to valid heap addresses, which allows remote attackers to execute arbitrary code via a crafted applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-3748 
Buffer overflow in the UPnP IGD (Internet Gateway Device Standardized Device Control Protocol) implementation in iChat on Apple Mac OS X 10.3.9 and 10.4.10 allows network-adjacent remote attackers to execute arbitrary code via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-03T10:00:00.000Z
CVE-2007-3749 
The kernel in Apple Mac OS X 10.4 through 10.4.10 does not reset the current Mach Thread Port or Thread Exception Port when executing a setuid program, which allows local users to execute arbitrary code by creating the port before launching the setuid program, then writing to the address space of the setuid process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T01:00:00.000Z
CVE-2007-3750 
Heap-based buffer overflow in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via crafted Sample Table Sample Descriptor (STSD) atoms in a movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-07T20:00:00.000Z
CVE-2007-3751 
Unspecified vulnerability in QuickTime for Java in Apple QuickTime before 7.3 allows remote attackers to execute arbitrary code via untrusted Java applets that gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-07T20:00:00.000Z
CVE-2007-3752 
Heap-based buffer overflow in Apple iTunes before 7.4 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via crafted album cover art in the covr atom of an MP4/AAC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-06T21:00:00.000Z
CVE-2007-3753 
Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service (application termination) and execute arbitrary code via crafted Service Discovery Protocol (SDP) packets, related to insufficient input validation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T21:00:00.000Z
CVE-2007-3754 
Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T21:00:00.000Z
CVE-2007-3755 
Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a "tel:" link, which does not prompt the user before dialing the number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T21:00:00.000Z
CVE-2007-3756 
Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to obtain sensitive information via a crafted web page that identifies the URL of the parent window, even when the parent window is in a different domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T21:00:00.000Z
CVE-2007-3757 
Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that will be dialed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T21:00:00.000Z
CVE-2007-3758 
Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting (XSS) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T22:00:00.000Z
CVE-2007-3759 
Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T22:00:00.000Z
CVE-2007-3760 
Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T22:00:00.000Z
CVE-2007-3761 
Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-27T22:00:00.000Z
CVE-2007-3762 
Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3763 
The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3764 
The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a certain data length value in a crafted packet, which results in an "overly large memcpy."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3765 
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3768 
The mirror mechanism in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to cause a denial of service (restart) via a malformed response to a PASV command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-3769 
Cross-site scripting (XSS) vulnerability in the mirrored server management interface in SurgeFTP 2.3a1 allows user-assisted, remote FTP servers to inject arbitrary web script or HTML via a malformed response without a status code, which is reflected to the user in the resulting error message.  NOTE: this can be leveraged for root access via a sequence of steps involving web script that creates a new FTP user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-3770 
The terminal_helper_execute function in terminal/terminal.c in Xfce Terminal 0.2.6 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a crafted link, as demonstrated using the "Open Link" functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T21:00:00.000Z
CVE-2007-3771 
Stack-based buffer overflow in the Internet E-mail Auto-Protect feature in Symantec AntiVirus Corporate Edition before 10.1, and Client Security before 3.1, allows local users to cause a denial of service (service crash) via a long (1) To, (2) From, or (3) Subject header in an outbound SMTP e-mail message.  NOTE: the original vendor advisory referenced CVE-2006-3456, but this was an error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3772 
Directory traversal vulnerability in news/show.php in PsNews 1.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the newspath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3773 
Cross-site request forgery (CSRF) vulnerability in the Email-Template module in Generic YouTube Clone Script allows remote attackers to upload files with arbitrary file types to templates/emails/ as administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3774 
Dvbbs 7.1.0 SP1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for Data/Dvbbs7.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3775 
Unspecified vulnerability in Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allows remote attackers to cause a denial of service (loss of cluster services) via unspecified vectors, aka (1) CSCsj09859 and (2) CSCsj19985.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3776 
Cisco Unified Communications Manager (CUCM, formerly CallManager) and Unified Presence Server (CUPS) allow remote attackers to obtain sensitive information via unspecified vectors that reveal the SNMP community strings and configuration settings, aka (1) CSCsj20668 and (2) CSCsj25962.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3777 
avg7core.sys 7.5.0.444 in Grisoft AVG Anti-Virus 7.5.448 and Free Edition 7.5.446, provides an internal function that copies data to an arbitrary address, which allows local users to gain privileges via arbitrary address arguments to a function provided by the 0x5348E004 IOCTL for the generic DeviceIoControl handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3778 
The G/PGP (GPG) Plugin 2.0, and 2.1dev before 20060912, for Squirrelmail allows remote attackers to execute arbitrary commands via shell metacharacters in the messageSignedText parameter to the gpg_check_sign_pgp_mime function in gpg_hook_functions.php.  NOTE: a parameter value can be set in the contents of an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3779 
PHP local file inclusion vulnerability in gpg_pop_init.php in the G/PGP (GPG) Plugin before 20070707 for Squirrelmail allows remote attackers to include and execute arbitrary local files, related to the MOD parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3780 
MySQL Community Server before 5.0.45 allows remote attackers to cause a denial of service (daemon crash) via a malformed password packet in the connection protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3781 
MySQL Community Server before 5.0.45 does not require privileges such as SELECT for the source table in a CREATE TABLE LIKE statement, which allows remote authenticated users to obtain sensitive information such as the table structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3782 
MySQL Community Server before 5.0.45 allows remote authenticated users to gain update privileges for a table in another database via a view that refers to this external table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3783 
SQL injection vulnerability in default.asp in enVivo!CMS allows remote attackers to execute arbitrary SQL commands via the ID parameter in an article action.  NOTE: this is probably different from CVE-2005-1413.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T22:00:00.000Z
CVE-2007-3784 
Cross-site scripting (XSS) vulnerability in the Belkin G Plus Router F5D7231-4 with firmware 4.05.03 allows remote attackers to inject arbitrary web script or HTML via a hostname of a DHCP client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3785 
Absolute path traversal vulnerability in a certain ActiveX control in PGPBBox.dll in EldoS SecureBlackbox (sbb) 5.1.0.112 allows remote attackers to create or overwrite arbitrary files via a full pathname in the argument to the SaveToFile method.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3786 
Cross-site request forgery (CSRF) vulnerability on the eSoft InstaGate EX2 UTM device before firmware 3.1.20070615 allows remote attackers to perform privileged actions as administrators.  NOTE: the vendor disputes the distribution of the vulnerable software, stating that it was a custom build for a former customer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3787 
The eSoft InstaGate EX2 UTM device does not require entry of the old password when changing the admin password, which might allow remote attackers to gain privileges by conducting a CSRF attack, making a password change from an unattended workstation, or other attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3788 
The eSoft InstaGate EX2 UTM device stores the admin password within the settings HTML document, which might allow context-dependent attackers to obtain sensitive information by reading this document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3789 
SQL injection vulnerability in admin/index.php in Inmostore 4.0 allows remote attackers to execute arbitrary SQL commands via the Password field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3790 
The com_print_typeinfo function in the bz2 extension in PHP 5.2.3 allows context-dependent attackers to cause a denial of service via a long argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3791 
Buffer overflow in the w_read function in sockets.c in Cami Sardinha and Nigel Kukard policyd before 1.81 for Postfix allows remote attackers to cause a denial of service and possibly execute arbitrary code via long SMTP commands.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3792 
Multiple PHP remote file inclusion vulnerabilities in AzDG Dating Gold 3.0.5 allow remote attackers to execute arbitrary PHP code via a URL in the int_path parameter to (1) header.php, (2) footer.php, or (3) secure.admin.php in templates/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3793 
SQL injection vulnerability in Job Management Partner 1/NETM/DM (JP1/NETM/DM) Manager on Windows before 20070413 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3794 
Buffer overflow in Hitachi Cosminexus V4 through V7, Processing Kit for XML before 20070511, Developer's Kit for Java before 20070312, and third-party products that use this software, allows attackers to have an unknown impact via certain GIF images, related to use of GIF image processing APIs by a Java application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3795 
Unspecified vulnerability in Hitachi TP1/Server Base before 03-05-/P, 05-00-x before 05-00-/G, 05-01-x before 05-01-/A, and 05-02-x before 05-02-/C on HP-UX 11.0 through 11i v3 allows attackers to cause a denial of service by sending certain data to a port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-15T23:00:00.000Z
CVE-2007-3796 
The password reset feature in the Spam Quarantine HTTP interface for MailMarshal SMTP 6.2.0.x before 6.2.1 allows remote attackers to modify arbitrary account information via a UserId variable with a large amount of trailing whitespace followed by a malicious value, which triggers SQL buffer truncation due to length inconsistencies between variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-17T23:00:00.000Z
CVE-2007-3798 
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-16T22:00:00.000Z