rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-7256 
mm/shmem.c in the Linux kernel before 2.6.28-rc8, when strict overcommit is enabled and CONFIG_SECURITY is disabled, does not properly handle the export of shmemfs objects by knfsd, which allows attackers to cause a denial of service (NULL pointer dereference and knfsd crash) or possibly have unspecified other impact via unknown vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-1643.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-03T14:00:00.000Z
CVE-2008-7257 
CRLF injection vulnerability in +webvpn+/index.html in WebVPN on Cisco Adaptive Security Appliances (ASA) 5580 series devices with software before 8.1(2) allows remote attackers to inject arbitrary HTTP headers as demonstrated by a redirect attack involving a %0d%0aLocation%3a sequence in a URI, or conduct HTTP response splitting attacks via unspecified vectors, aka Bug ID CSCsr09163.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-29T18:00:00.000Z
CVE-2008-7258 
The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character.  NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-20T17:00:00.000Z
CVE-2008-7261 
The Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-010 records DEBUG messages containing user credentials in the log4j.xml file, which might allow local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2008-7262 
Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary files and directories via vectors involving a symlink in a pathname to a (1) CWD, (2) DELE, (3) STOR, or (4) RETR command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2008-7263 
ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2008-7264 
The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2008-7265 
The pr_data_xfer function in ProFTPD before 1.3.2rc3 allows remote authenticated users to cause a denial of service (CPU consumption) via an ABOR command during a data transfer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2008-7266 
Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in RSA Adaptive Authentication 2.x and 5.7.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-26T19:00:00.000Z
CVE-2008-7267 
SQL injection vulnerability in announcements.php in SiteEngine 5.x allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-01T16:00:00.000Z
CVE-2008-7268 
The phpinfo function in SiteEngine 5.x allows remote attackers to obtain system information by setting the action parameter to php_info in misc.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-01T16:00:00.000Z
CVE-2008-7269 
Open redirect vulnerability in api.php in SiteEngine 5.x allows user-assisted remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the forward parameter in a logout action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-01T16:00:00.000Z
CVE-2008-7270 
OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-06T22:00:00.000Z
CVE-2008-7271 
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via (1) the searchWord parameter to help/advanced/searchView.jsp or (2) the workingSet parameter in an add action to help/advanced/workingSetManager.jsp, a different issue than CVE-2010-4647.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-13T18:35:00.000Z
CVE-2008-7272 
FireGPG before 0.6 handle user’s passphrase and decrypted cleartext insecurely by writing pre-encrypted cleartext and the user's passphrase to disk which may result in the compromise of secure communication or a users’s private key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-07T23:40:32.000Z
CVE-2008-7273 
A symlink issue exists in Iceweasel-firegpg before 0.6 due to insecure tempfile handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-18T21:18:15.000Z
CVE-2008-7274 
IBM WebSphere Application Server (WAS) 6.1.0.9, when the JAAS Login functionality is enabled, allows attackers to perform an internal application hashtable login by (1) not providing a password or (2) providing an empty password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-14T23:00:00.000Z
CVE-2008-7275 
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) before 2.3.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) AgentTicketMailbox or (2) CustomerTicketOverView.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7276 
Kernel/System/Web/Request.pm in Open Ticket Request System (OTRS) before 2.3.2 creates a directory under /tmp/ with 1274 permissions, which might allow local users to bypass intended access restrictions via standard filesystem operations, related to incorrect interpretation of 0700 as a decimal value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7277 
Open Ticket Request System (OTRS) before 2.3.0-beta4 checks for the rw permission, instead of the configured merge permission, during authorization of merge operations, which might allow remote authenticated users to bypass intended access restrictions by merging two tickets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7278 
The S/MIME feature in Open Ticket Request System (OTRS) before 2.2.5, and 2.3.x before 2.3.0-beta1, does not properly configure the RANDFILE environment variable for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7279 
The CustomerInterface component in Open Ticket Request System (OTRS) before 2.2.8 allows remote authenticated users to bypass intended access restrictions and access tickets of arbitrary customers via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7280 
Kernel/System/EmailParser.pm in PostmasterPOP3.pl in Open Ticket Request System (OTRS) before 2.2.7 does not properly handle e-mail messages containing malformed UTF-8 characters, which allows remote attackers to cause a denial of service (e-mail retrieval outage) via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7281 
Open Ticket Request System (OTRS) before 2.2.7 sends e-mail containing a Bcc header field that lists the Blind Carbon Copy recipients, which allows remote attackers to obtain potentially sensitive e-mail address information by reading this field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7282 
Kernel/Output/HTML/CustomerNewTicketQueueSelectionGeneric.pm in Open Ticket Request System (OTRS) before 2.2.6, when the CustomerPanelOwnSelection and CustomerGroupSupport options are enabled, allows remote authenticated users to bypass intended access restrictions, and perform certain (1) list and (2) write operations on queues, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7283 
Open Ticket Request System (OTRS) before 2.2.6, when customer group support is enabled, allows remote authenticated users to bypass intended access restrictions and perform web-interface updates to tickets by leveraging queue read permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2008-7284 
IBM Lotus Quickr 8.1 before 8100.003 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by clicking a download link, aka SPR QCAO7E6AM8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2008-7285 
Unspecified vulnerability in the docnote string handling implementation in IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, aka SPR JFLD7GZT25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2008-7286 
IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino does not properly handle URLs that request images, which allows remote authenticated users to cause a denial of service (daemon crash) via a request to resources.nsf, aka SPR XFXF7JDBCX.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2008-7287 
Multiple memory leaks in the (1) ldap_init and (2) ldap_url_search_direct API functions in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 allow remote authenticated users to cause a denial of service (memory consumption) by making many function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2008-7288 
IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 on AIX allows remote attackers to cause a denial of service (server destabilization) via an anonymous DIGEST-MD5 LDAP Bind operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2008-7289 
IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 does not properly handle the simultaneous changing of multiple passwords, which makes it easier for remote authenticated users to cause a denial of service (DB2 daemon deadlock) by making password changes that trigger updates to a DB2 password-history table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2008-7290 
Memory leak in the ldap_explode_rdn API function in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-LA0007 allows remote authenticated users to cause a denial of service (memory consumption) by making many function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2008-7291 
gri before 2.12.18 generates temporary files in an insecure way.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-07T23:51:32.000Z
CVE-2008-7292 
Bugzilla 2.20.x before 2.20.5, 2.22.x before 2.22.3, and 3.0.x before 3.0.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local users to obtain sensitive information by reading these files, a different vulnerability than CVE-2011-2977.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-09T19:00:00.000Z
CVE-2008-7293 
Mozilla Firefox before 4 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-09T19:00:00.000Z
CVE-2008-7294 
Google Chrome before 4.0.211.0 cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-09T19:00:00.000Z
CVE-2008-7295 
Microsoft Internet Explorer cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-09T19:00:00.000Z
CVE-2008-7296 
Apple Safari cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-09T19:00:00.000Z
CVE-2008-7297 
Opera cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-09T19:00:00.000Z
CVE-2008-7298 
The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-09T19:00:00.000Z
CVE-2008-7299 
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-12T17:00:00.000Z
CVE-2008-7300 
The labeled networking implementation in Solaris Trusted Extensions in Sun Solaris 10 and OpenSolaris snv_39 through snv_67, when a labeled zone is in the installed state, allows remote authenticated users to bypass a Mandatory Access Control (MAC) policy and obtain access to the global zone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-05T01:00:00.000Z
CVE-2008-7301 
SQL injection vulnerability in admin/login.php in jSite 1.0 OE allows remote attackers to execute arbitrary SQL commands via the username parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-05T01:00:00.000Z
CVE-2008-7302 
SQL injection vulnerability in netinvoice.php in the nBill (com_netinvoice) component 1.2.0 SP1 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors involving "knowledge of ... the contents of an encrypted file."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-05T01:00:00.000Z
CVE-2008-7303 
The nonet and nointernet sandbox profiles in Apple Mac OS X 10.5.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of launchctl to trigger the launchd daemon's execution of a script file, a related issue to CVE-2011-1516.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-15T18:00:00.000Z
CVE-2008-7309 
Insoshi before 20080920 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the ForumPost user_id value via a modified URL, related to a "mass assignment" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-04T22:00:00.000Z
CVE-2008-7310 
Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-04T22:00:00.000Z
CVE-2008-7311 
The session cookie store implementation in Spree 0.2.0 uses a hardcoded config.action_controller_session hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the config/environment.rb file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-04T22:00:00.000Z
CVE-2008-7312 
The Filtering Service in Websense Enterprise 5.2 through 6.3 does not consider the IP address during URL categorization, which makes it easier for remote attackers to bypass filtering via an HTTP request, as demonstrated by a request to a compromised server associated with a specific IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-23T10:00:00.000Z
CVE-2008-7313 
The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands.  NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-31T15:00:00.000Z
CVE-2008-7314 
mIRC before 6.35 allows attackers to cause a denial of service (crash) via a long nickname.
Problem types: description: Other
Affected products: vendor: mIRC
product: mIRC
Published: 2020-01-23T14:48:47.000Z
CVE-2008-7315 
UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-10T16:00:00.000Z
CVE-2008-7316 
mm/filemap.c in the Linux kernel before 2.6.25 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers an iovec of zero length, followed by a page fault for an iovec of nonzero length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-02T10:00:00.000Z
CVE-2008-7319 
The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell metacharacters before use of backticks in External.pm, allowing for shell command injection and arbitrary command execution if untrusted input is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-11-07T21:00:00.000Z
CVE-2008-7320 
GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-18T19:00:00.000Z
CVE-2008-7321 
The tubepress plugin before 1.6.5 for WordPress has XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T13:13:41.000Z
CVE-2009-0001 
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted RTSP URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2009-0002 
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a QTVR movie file with crafted THKD atoms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2009-0003 
Heap-based buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via an AVI movie file with an invalid nBlockAlign value in the _WAVEFORMATEX structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2009-0004 
Buffer overflow in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted MP3 audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2009-0005 
Unspecified vulnerability in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a crafted H.263 encoded movie file that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z
CVE-2009-0006 
Integer signedness error in Apple QuickTime before 7.6 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via a Cinepak encoded movie file with a crafted MDAT atom that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-01-21T20:00:00.000Z