rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-5660 
Cisco Security Agent Management Center (CSAMC) 5.1 before 5.1.0.79 does not properly handle certain LDAP error messages, which allows remote attackers to bypass authentication requirements via an empty password when using an external LDAP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T00:00:00.000Z
CVE-2006-5661 
Cross-site scripting (XSS) vulnerability in nquser.php in VIRtech Netquery allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T00:00:00.000Z
CVE-2006-5662 
SQL injection vulnerability in easy notesManager (eNM) 0.0.1 allows remote attackers to execute arbitrary SQL commands via (1) the username parameter in login.php and (2) a search on the "search page."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T00:00:00.000Z
CVE-2006-5663 
IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 use insecure permissions for installation scripts, which allows local users to gain privileges by modifying the scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5664 
The installation script in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit (CSDK) 2.90, and Informix I-Connect 2.90 allows local users to "compromise security" via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5665 
PHP remote file inclusion vulnerability in admin/modules_data.php in the phpBB module Spider Friendly 1.3.10 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5666 
SQL injection vulnerability in includes/menu.inc.php in E-Annu 1.0 allows remote attackers to execute arbitrary SQL commands via the login parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5667 
Multiple PHP remote file inclusion vulnerabilities in P-Book 1.17 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the pb_lang parameter to (1) admin.php and (2) pbook.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5668 
Unspecified vulnerability in Ampache 3.3.2 and earlier, when register_globals is enabled, allows remote attackers to bypass security restrictions and gain guest access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5669 
PHP remote file inclusion vulnerability in gestion/savebackup.php in Gepi 1.4.0 and earlier, and possibly other versions before 1.4.4, allows remote attackers to execute arbitrary PHP code via a URL in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5670 
PHP remote file inclusion vulnerability in forgot_pass.php in Free Image Hosting 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5671 
PHP remote file inclusion vulnerability in contact.php in Free Image Hosting 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5672 
PHP remote file inclusion vulnerability in web/init_mysource.php in MySource CMS 2.16.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the INCLUDE_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5673 
PHP remote file inclusion vulnerability in bb_func_txt.php in miniBB 2.0.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5674 
Multiple PHP remote file inclusion vulnerabilities in miniBB 2.0.2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter to (1) bb_func_forums.php, (2) bb_functions.php, or (3) the RSS plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T01:00:00.000Z
CVE-2006-5675 
Multiple unspecified vulnerabilities in Pentaho Business Intelligence (BI) Suite before 1.2 RC3 (1.2.0.470-RC3) have unknown impact and attack vectors, related to "MySQL Scripts need changes for security," possibly SQL injection vulnerabilities associated with these scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T02:00:00.000Z
CVE-2006-5676 
SQL injection vulnerability in consult/classement.php in Uni-Vert PhpLeague 0.82 and earlier allows remote attackers to execute arbitrary SQL commands via the champ parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T02:00:00.000Z
CVE-2006-5677 
resmom/start_exec.c in pbs_mom in TORQUE Resource Manager 2.0.0p8 and earlier allows local users to create arbitrary files via a symlink attack on (1) a job output file in /usr/spool/PBS/spool and possibly (2) a job file in /usr/spool/PBS/mom_priv/jobs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T11:00:00.000Z
CVE-2006-5678 
PHP remote file inclusion vulnerability in common/visiteurs/include/library.inc.php in J-Pierre DEZELUS Les Visiteurs 2.0.1, as used in phpMyConferences (phpMyConference) 8.0.2 and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the lvc_modules_dir parameter.  NOTE: CVE disputes this vulnerability, because the inclusion occurs in a function that is not called during a direct request to library.inc.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T11:00:00.000Z
CVE-2006-5679 
Integer overflow in the ffs_mountfs function in FreeBSD 6.1 allows local users to cause a denial of service (panic) and possibly execute arbitrary code via a crafted UFS filesystem that causes invalid or large size parameters to be provided to the kmem_alloc function. NOTE: a third party states that this issue does not cross privilege boundaries in FreeBSD because only root may mount a filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T22:00:00.000Z
CVE-2006-5680 
The libarchive library in FreeBSD 6-STABLE after 2006-09-05 and before 2006-11-08 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive that causes libarchive to skip a region past the actual end of the archive, which triggers an infinite loop that attempts to read more data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-09T00:00:00.000Z
CVE-2006-5681 
QuickTime for Java on Mac OS X 10.4 through 10.4.8, when used with Quartz Composer, allows remote attackers to obtain sensitive information (screen images) via a Java applet that accesses images that are being rendered by other embedded QuickTime objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-20T02:00:00.000Z
CVE-2006-5701 
Double free vulnerability in squashfs module in the Linux kernel 2.6.x, as used in Fedora Core 5 and possibly other distributions, allows local users to cause a denial of service by mounting a crafted squashfs filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-03T23:00:00.000Z
CVE-2006-5702 
Tikiwiki 1.9.5 allows remote attackers to obtain sensitive information (MySQL username and password) via an empty sort_mode parameter in (1) tiki-listpages.php, (2) tiki-lastchanges.php, (3) messu-archive.php, (4) messu-mailbox.php, (5) messu-sent.php, (6) tiki-directory_add_site.php, (7) tiki-directory_ranking.php, (8) tiki-directory_search.php, (9) tiki-forums.php, (10) tiki-view_forum.php, (11) tiki-friends.php, (12) tiki-list_blogs.php, (13) tiki-list_faqs.php, (14) tiki-list_trackers.php, (15) tiki-list_users.php, (16) tiki-my_tiki.php, (17) tiki-notepad_list.php, (18) tiki-orphan_pages.php, (19) tiki-shoutbox.php, (20) tiki-usermenu.php, and (21) tiki-webmail_contacts.php, which reveal the information in certain database error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5703 
Cross-site scripting (XSS) vulnerability in tiki-featured_link.php in Tikiwiki 1.9.5 allows remote attackers to inject arbitrary web script or HTML via a url parameter that evades filtering, as demonstrated by a parameter value containing malformed, nested SCRIPT elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5704 
HP NonStop Server G06.29, when running Standard Security T6533G06 before T6533G06^ABK, does not properly evaluate access permissions to OSS directories when no optional ACL entry exists, which allows local users to read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5705 
Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the (1) backup and (2) fragment parameters in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5706 
Unspecified vulnerabilities in PHP, probably before 5.2.0, allow local users to bypass open_basedir restrictions and perform unspecified actions via unspecified vectors involving the (1) chdir and (2) tempnam functions.  NOTE: the tempnam vector might overlap CVE-2006-1494.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5707 
SQL injection vulnerability in index.php in PHPEasyData Pro 1.4.1 and 2.2.1 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5708 
Multiple unspecified vulnerabilities in MDaemon and WorldClient in Alt-N Technologies MDaemon before 9.50 allow attackers to cause a denial of service (memory consumption) via unspecified vectors resulting in memory leaks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5709 
Unspecified vulnerability in WorldClient in Alt-N Technologies MDaemon before 9.50 has unknown impact and attack vectors related to a "JavaScript exploit."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5710 
The Airport driver for certain Orinoco based Airport cards in Darwin kernel 8.8.0 in Apple Mac OS X 10.4.8, and possibly other versions, allows remote attackers to execute arbitrary code via an 802.11 probe response frame without any valid information element (IE) fields after the header, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5711 
ECI Telecom B-FOCuS Wireless 802.11b/g ADSL2+ Router allows remote attackers to read arbitrary files via a certain HTTP request, as demonstrated by a request for a router configuration file, related to the /html/defs/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5712 
Cross-site scripting (XSS) vulnerability in Mirapoint WebMail allows remote attackers to inject arbitrary web script via the expression Cascading Style Sheets (CSS) function, as demonstrated using the width style for an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5713 
Cross-site scripting (XSS) vulnerability in Easy File Sharing (EFS) Web Server 4.0 allows remote attackers to inject arbitrary web script or HTML via the (1) author, (2) content, or (3) title parameters when posting a forum thread.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5714 
Easy File Sharing (EFS) Web Server 4.0, when running on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of a HTTP GET request, which accesses the alternate data stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5715 
Easy File Sharing (EFS) Easy Address Book 1.2, when run on an NTFS file system, allows remote attackers to read arbitrary files under the web root by appending "::$DATA" to the end of an HTTP GET request, which accesses the alternate data stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5716 
Directory traversal vulnerability in aff_news.php in FreeNews 2.1 allows remote attackers to include local files via a .. (dot dot) sequence in the chemin parameter, when the aff_news parameter is not set to "1."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5717 
Multiple cross-site scripting (XSS) vulnerabilities in Zend Google Data Client Library (ZendGData) Preview 0.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in (1) basedemo.php and (2) calenderdemo.php in samples/, and other unspecified files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5718 
Cross-site scripting (XSS) vulnerability in error.php in phpMyAdmin 2.6.4 through 2.9.0.2 allows remote attackers to inject arbitrary web script or HTML via UTF-7 or US-ASCII encoded characters, which are injected into an error message, as demonstrated by a request with a utf7 charset parameter accompanied by UTF-7 data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5719 
SQL injection vulnerability in libs/sessions.lib.php in BytesFall Explorer (bfExplorer) 0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified parameters, a different issue than CVE-2006-5606.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5720 
SQL injection vulnerability in modules/journal/search.php in the Journal module in Francisco Burzi PHP-Nuke 7.9 and earlier allows remote attackers to execute arbitrary SQL commands via the forwhat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5721 
The \Device\SandBox driver in Outpost Firewall PRO 4.0 (964.582.059) allows local users to cause a denial of service (system crash) via an invalid argument to the DeviceIoControl function that triggers an invalid memory operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5722 
Multiple PHP remote file inclusion vulnerabilities in Segue CMS 1.5.9 and earlier, when magic_quotes_gpc is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the theme parameter to (1) themesettings.php or (2) index.php, a different vector than CVE-2006-5497.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5723 
SQL injection vulnerability in DataparkSearch Engine 4.42 and earlier allows remote attackers to execute arbitrary SQL commands via a malformed hostname in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5724 
Heap-based buffer overflow the "Answering Service" function in ICQ 2003b Build 3916 allows local users to cause a denial of service (application crash) via a long string in the "AwayMsg Presets" value in the ICQ\ICQPro\DefaultPrefs\Presets registry key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5725 
The SSL server in AEP Smartgate 4.3b allows remote attackers to determine existence of directories via a direct request for a directory URI, which returns different HTTP status codes for existing and non-existing directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-04T01:00:00.000Z
CVE-2006-5726 
alloccgblk in the UFS filesystem in Solaris 10 allows local users to cause a denial of service (memory corruption) by mounting crafted UFS filesystems with malformed data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T17:00:00.000Z
CVE-2006-5727 
PHP remote file inclusion vulnerability in admin/controls/cart.php in sazcart 1.5 allows remote attackers to execute arbitrary PHP code via the (1) _saz[settings][shippingfolder] and (2) _saz[settings][taxfolder] parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T17:00:00.000Z
CVE-2006-5728 
XM Easy Personal FTP Server 5.2.1 and earlier allows remote authenticated users to cause a denial of service via a long argument to the NLST command, possibly involving the -al flags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T17:00:00.000Z
CVE-2006-5729 
Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to (1) reply to a message in an arbitrary forum, if authorized to create a message in any forum; and (2) perform certain unauthorized forum actions, related to an "error in how the permissions were assembled" that assigns extra permissions to users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5730 
PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS 0.9.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter.  NOTE: it is possible that this is a vulnerability in FCKeditor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5731 
Directory traversal vulnerability in classes/index.php in Lithium CMS 4.04c and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the siteconf[curl] parameter, as demonstrated by a POST to news/comment.php containing PHP code, which is stored under db/comments/news/ and included by classes/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5732 
SQL injection vulnerability in logout.php in T.G.S. CMS 0.1.7 and earlier allows remote attackers to execute arbitrary SQL commands via the myauthorid cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5733 
Directory traversal vulnerability in error.php in PostNuke 0.763 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PNSVlang (PNSV lang) cookie, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by error.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5734 
Multiple PHP remote file inclusion vulnerabilities in ATutor 1.5.3.2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) section parameter in (a) documentation/common/frame_toc.php and (b) documentation/common/search.php, the (2) req_lang parameter in documentation/common/search.php and (c) documentation/common/vitals.inc.php, the (3) row[dir_name] parameter in (d) include/classes/module/module.class.php, and the (4) lang_path parameter in (e) include/classes/phpmailer/class.phpmailer.php.  NOTE: the print.php vector is already covered by CVE-2005-3404.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5735 
Directory traversal vulnerability in include/common.php in PunBB before 1.2.14 allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the language parameter, related to register.php storing a language value in the users table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5736 
SQL injection vulnerability in search.php in PunBB before 1.2.14, when the PHP installation is vulnerable to CVE-2006-3017, allows remote attackers to execute arbitrary SQL commands via the result_list array parameter, which is not initialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5737 
PunBB uses a predictable cookie_seed value that can be derived from the time of registration of the superadmin account (installation time), which might allow local users to perform unauthorized actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5738 
Multiple SQL injection vulnerabilities in PunBB before 1.2.14 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5739 
PHP remote file inclusion vulnerability in cpadmin/cpa_index.php in Leicestershire communityPortals 1.0_2005-10-18_12-31-18 allows remote attackers to execute arbitrary PHP code via a URL in the cp_root_path parameter, a different vector than CVE-2006-5280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-06T18:00:00.000Z
CVE-2006-5740 
Unspecified vulnerability in the LDAP dissector in Wireshark (formerly Ethereal) 0.99.3 allows remote attackers to cause a denial of service (crash) via a crafted LDAP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-10-27T23:00:00.000Z