rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-3540 
Multiple cross-site scripting (XSS) vulnerabilities in search.asp in rwAuction Pro 5.0 allow remote attackers to inject arbitrary web script or HTML via the (1) search, (2) show, (3) searchtype, (4) catid, and (5) searchtxt parameters, a different version and vectors than CVE-2005-4060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3541 
Cross-site scripting (XSS) vulnerability in Kurinton sHTTPd 20070408 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3542 
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3543 
Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code by making a post that specifies a .php filename in the _wp_attached_file metadata field; and then sending this file's content, along with its post_ID value, to (1) wp-app.php or (2) app.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3544 
Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code via unspecified vectors, possibly related to the wp_postmeta table and the use of custom fields in normal (non-attachment) posts.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-3543.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3545 
Buffer overflow in Warzone 2100 Resurrection before 2.0.7 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long filename when setting background music.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3546 
Cross-site scripting (XSS) vulnerability in the Windows GUI in Nessus Vulnerability Scanner before 3.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3547 
Directory traversal vulnerability in qti_checkname.php in QuickTicket 1.2 allows remote attackers to include and execute arbitrary local files a .. (dot dot) in the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T20:00:00.000Z
CVE-2007-3548 
Stack-based buffer overflow in W3Filer 2.1.3 allows remote FTP servers to cause a denial of service (application hang or crash) and possibly execute arbitrary code by sending a large banner to a client that is sending a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T21:00:00.000Z
CVE-2007-3549 
SQL injection vulnerability in view_sub_cat.php in Buddy Zone 1.5 allows remote attackers to execute arbitrary SQL commands via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T21:00:00.000Z
CVE-2007-3550 
Microsoft Internet Explorer 6.0 and 7.0 allows remote attackers to fill Zones with arbitrary domains using certain metacharacters such as wildcards via JavaScript, which results in a denial of service (website suppression and resource consumption), aka "Internet Explorer Zone Domain Specification Dos and Page Suppressing".  NOTE: this issue has been disputed by a third party, who states that the zone settings cannot be manipulated
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T21:00:00.000Z
CVE-2007-3551 
Buffer overflow in bbs100 before 3.2 allows remote attackers to cause a denial of service (crash) by attempting to login as the Guest user when another Guest user is already logged in, possibly related to the state_login_prompt function in state_login.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T21:00:00.000Z
CVE-2007-3552 
Multiple unspecified vulnerabilities in bbs100 before 3.2 allow remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving certain v*printf and shift_StringIO functions.  NOTE: some details were obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T21:00:00.000Z
CVE-2007-3553 
Cross-site scripting (XSS) vulnerability in Rapid Install Web Server in Oracle Application Server 11i allows remote attackers to inject arbitrary web script or HTML via a URL to the "Secondary Login Page", as demonstrated using (1) pls/ and (2) pls/MSBEP004/.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T21:00:00.000Z
CVE-2007-3554 
Stack-based buffer overflow in the HPSDDX Class (SDD) ActiveX control in sdd.dll in HP Instant Support - Driver Check before 1.5.0.3 allows remote attackers to execute arbitrary code via a long argument to the queryHub function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T15:00:00.000Z
CVE-2007-3555 
Cross-site scripting (XSS) vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T15:00:00.000Z
CVE-2007-3556 
Liesbeth base CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an include file containing account credentials via a direct request for config.inc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T15:00:00.000Z
CVE-2007-3557 
SQL injection vulnerability in admin/login.php in Wheatblog (wB) 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the login parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T16:00:00.000Z
CVE-2007-3558 
SQL injection vulnerability in Coppermine Photo Gallery (CPG) before 1.4.11 allows remote attackers to execute arbitrary SQL commands via an album password cookie to an unspecified component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T16:00:00.000Z
CVE-2007-3559 
Cross-site scripting (XSS) vulnerability in infusions/shoutbox_panel/shoutbox_panel.php in PHP-Fusion 6.01.10 and 6.01.9, when guest posts are enabled, allows remote authenticated users to inject arbitrary web script or HTML via the URI, related to the FUSION_QUERY constant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T16:00:00.000Z
CVE-2007-3560 
Multiple unspecified vulnerabilities in Esqlanelapse before 2.6 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T16:00:00.000Z
CVE-2007-3561 
Cross-site scripting (XSS) vulnerability in ara.asp in Efendy Blog 1.0 allows remote attackers to inject arbitrary web script or HTML via the ara parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T16:00:00.000Z
CVE-2007-3562 
SQL injection vulnerability in videos.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T16:00:00.000Z
CVE-2007-3563 
SQL injection vulnerability in includes/view_page.php in AV Arcade 2.1b allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_page action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-04T16:00:00.000Z
CVE-2007-3564 
libcurl 7.14.0 through 7.16.3, when built with GnuTLS support, does not check SSL/TLS certificate expiration or activation dates, which allows remote attackers to bypass certain access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-18T17:00:00.000Z
CVE-2007-3566 
Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-26T18:00:00.000Z
CVE-2007-3567 
MySQLDumper 1.21b through 1.23 REV227 uses a "Limit GET" statement in the .htaccess authentication mechanism, which allows remote attackers to bypass authentication requirements via HTTP POST requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T19:00:00.000Z
CVE-2007-3568 
The _LoadBMP function in imlib 1.9.15 and earlier allows context-dependent attackers to cause a denial of service (infinite loop) via a BMP image with a Bits Per Page (BPP) value of 0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T19:00:00.000Z
CVE-2007-3569 
Multiple cross-site scripting (XSS) vulnerabilities in Oliver Library Management System allow remote attackers to inject arbitrary web script or HTML via the (1) updateform and (2) displayform parameter to (a) gateway/gateway.exe; the (3) TERMS, (4) database, (5) srchad, (6) SuggestedSearch, and (7) searchform parameters to the (b) "Basic Search page"; and (8) username parameter when (c) logging on.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T19:00:00.000Z
CVE-2007-3570 
The Linux Access Gateway in Novell Access Manager before 3.0 SP1 Release Candidate 1 (RC1) allows remote attackers to bypass unspecified security controls via Fullwidth/Halfwidth Unicode encoded data in a HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T19:00:00.000Z
CVE-2007-3571 
The Apache Web Server as used in Novell NetWare 6.5 and GroupWise allows remote attackers to obtain sensitive information via a certain directive to Apache that causes the HTTP-Header response to be modified, which may reveal the server's internal IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T19:00:00.000Z
CVE-2007-3572 
Incomplete blacklist vulnerability in cgi-bin/runDiagnostics.cgi in the web interface on the Yoggie Pico and Pico Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the param parameter, as demonstrated by URL encoded "`" (backtick) characters (%60 sequences).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3573 
Multiple SQL injection vulnerabilities in akocomment allow remote attackers to execute arbitrary SQL commands via the (1) acparentid or (2) acitemid parameter to an unspecified component, different vectors than CVE-2006-1421.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3574 
Multiple cross-site scripting (XSS) vulnerabilities in setup.cgi on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.00.06 firmware allow remote attackers to inject arbitrary web script or HTML via the (1) c4_trap_ip_, (2) devname, (3) snmp_getcomm, or (4) snmp_setcomm parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3575 
SQL injection vulnerability in includes/functions in FreeDomain.co.nr Clone allows remote attackers to execute arbitrary SQL commands via the logindomain parameter to members.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3576 
Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the "script" character sequence, using the (1) vbscript: handler for scheme names with 7 through 9 characters, and the (2) javascript: handler for scheme names with 10 or more characters, which might allow remote attackers to bypass certain XSS protection schemes.  NOTE: other researchers dispute the significance of this issue, stating "this only works when typed in the address bar.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3577 
PHPIDS before 20070703 does not properly handle use of the substr method in (1) document.location.search and (2) document.referrer; (3) certain use of document.location.hash; (4) certain "window[eval" and similar expressions; (5) certain Function expressions; (6) certain '=' expressions, as demonstrated by a 'whatever="something"' sequence; and (7) certain "with" expressions, which allows remote attackers to inject arbitrary web script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3578 
PHPIDS before 20070703 does not properly handle (1) arithmetic expressions and (2) unclosed comments, which allows remote attackers to inject arbitrary web script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3579 
PHPIDS before 20070703 does not properly handle setting the .text property of a SCRIPT element before its attachment to the DOM, which allows remote attackers to inject arbitrary web script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3580 
PHPIDS does not properly handle certain code containing newlines, as demonstrated by a try/catch block within a loop, which allows user-assisted remote attackers to inject arbitrary web script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3581 
The Jedox Palo 1.5 client transmits the password in cleartext, which might allow remote attackers to obtain the password by sniffing the network, as demonstrated by starting Excel with the Palo plugin, opening a cube, and performing an Insert View.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3582 
SQL injection vulnerability in index.php in SuperCali PHP Event Calendar 0.4.0 allows remote attackers to execute arbitrary SQL commands via the o parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3583 
SQL injection vulnerability in details_news.php in Girlserv ads 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the idnew parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3584 
SQL injection vulnerability in viewforum.php in PNphpBB2 1.2i and earlier for Postnuke allows remote attackers to execute arbitrary SQL commands via the order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3585 
PHP remote file inclusion vulnerability in games.php in MyCMS 0.9.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3586 
Multiple direct static code injection vulnerabilities in MyCMS 0.9.8 and earlier allow remote attackers to inject arbitrary PHP code into (1) a _score.txt file via the score parameter, or (2) a _setby.txt file via a login cookie, which is then included by games.php.  NOTE: programs that use games.php might include (a) snakep.php, (b) tetrisp.php, and possibly other site-specific files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3587 
MyCMS 0.9.8 and earlier allows remote attackers to gain privileges via the admin cookie parameter, as demonstrated by a post to admin/settings.php that injects PHP code into settings.inc, which can then be executed via a direct request to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3588 
SQL injection vulnerability in reply.php in VBZooM 1.12 allows remote attackers to execute arbitrary SQL commands via the UserID parameter to sub-join.php.  NOTE: this may be the same as CVE-2006-3691.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2007-3589 
Multiple SQL injection vulnerabilities in b1gbb 2.24.0 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showthread.php or (2) showboard.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T22:00:00.000Z
CVE-2007-3590 
Cross-site scripting (XSS) vulnerability in visitenkarte.php in b1gBB 2.24.0 allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T22:00:00.000Z
CVE-2007-3591 
Unspecified vulnerability in Profile.php in Elite Bulletin Board before 1.0.10 allows remote attackers to modify profile information via unspecified vectors related to "a remote form," probably related to direct requests and missing authorization checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T18:00:00.000Z
CVE-2007-3592 
PM.php in Elite Bulletin Board before 1.0.10 allows remote authenticated users to delete arbitrary PM messages and conduct other attacks via modified id fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T18:00:00.000Z
CVE-2007-3593 
Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine NetFlow Analyzer 5 allow remote attackers to inject arbitrary web script or HTML via the (1) alpha parameter in (a) netflow/jspui/applicationList.jsp, the (2) task parameter in (b) netflow/jspui/appConfig.jsp, the (3) view parameter in (c) netflow/jspui/index.jsp, and the (4) rtype parameter in (d) netflow/jspui/selectDevice.jsp and (e) netflow/jspui/customReport.jsp. NOTE: it was later reported that vector 3 also affects 7.5 build 7500.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T18:00:00.000Z
CVE-2007-3594 
Multiple cross-site scripting (XSS) vulnerabilities in AdventNet ManageEngine OpManager 6 and 7 allow remote attackers to inject arbitrary web script or HTML via the (1) name parameter in (a) ping.do and (b) traceRoute.do in map/; the (2) reportName, (3) displayName, and (4) selectedNode parameters to (c) reports/ReportViewAction.do; the (5) operation parameter to (d) admin/ServiceConfiguration.do; and the (6) selectedNode and (7) selectedTab parameters to (e) admin/DeviceAssociation.do.  NOTE: the searchTerm parameter in Search.do is already covered by CVE-2006-2343.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T18:00:00.000Z
CVE-2007-3596 
inc/vul_check.inc in phpVideoPro before 0.8.8 permits non-alphanumeric characters in the sess_id parameter, which has unknown impact and remote attack vectors, probably cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T18:00:00.000Z
CVE-2007-3597 
Session fixation vulnerability in Zen Cart 1.3.7 and earlier allows remote attackers to hijack web sessions by setting the Cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T18:00:00.000Z
CVE-2007-3598 
index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module.  NOTE: the vendor disputes the changing of settings, reporting that the attack vector results in a "You are not permitted to execute this Operation" error message in a 5.0.3 demo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3599 
vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3600 
WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3601 
vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities via a (1) home page or (2) event list view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3602 
The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3603 
SQL injection vulnerability in the dashboard (include/utils/SearchUtils.php) in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigned_user_id parameter in a Potentials ListView action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3604 
vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3605 
Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP SAP GUI allows remote attackers to execute arbitrary code via a long argument to the PrepareToPostHTML function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2007-3606 
Heap-based buffer overflow in the rfcguisink.rfcguisink.1 ActiveX control in the EnjoySAP SAP GUI, on systems using ASCII versions, allows remote attackers to execute arbitrary code via a long first argument to the LaunchGui function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z