rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6548 
The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6549 
The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6550 
Cross-site scripting (XSS) vulnerability in glossaire.php in Glossaire 2.0 allows remote attackers to inject arbitrary web script or HTML via the letter parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T01:00:00.000Z
CVE-2008-6551 
Multiple directory traversal vulnerabilities in e-Vision CMS 2.0.2 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) an adminlang cookie to admin/ind_ex.php; or the module parameter to (2) 3rdparty/adminpart/add3rdparty.php, (3) polling/adminpart/addpolling.php, (4) contact/adminpart/addcontact.php, (5) brandnews/adminpart/addbrandnews.php, (6) newsletter/adminpart/addnewsletter.php, (7) game/adminpart/addgame.php, (8) tour/adminpart/addtour.php, (9) articles/adminpart/addarticles.php, (10) product/adminpart/addproduct.php, or (11) plain/adminpart/addplain.php in modules/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T16:00:00.000Z
CVE-2008-6552 
Red Hat Cluster Project 2.x allows local users to modify or overwrite arbitrary files via symlink attacks on files in /tmp, involving unspecified components in Resource Group Manager (aka rgmanager) before 2.03.09-1, gfs2-utils before 2.03.09-1, and CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T16:00:00.000Z
CVE-2008-6553 
microcms-admin-home.php in Implied by Design Micro CMS (Micro-CMS) 3.5 (aka 0.3.5) does not require authentication as an administrator, which allows remote attackers to (1) create administrative accounts via an add_admin action, (2) remove administrative accounts via a delete_admin action, and (3) modify administrative passwords via a change_password action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T16:00:00.000Z
CVE-2008-6554 
cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T20:00:00.000Z
CVE-2008-6555 
cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T20:00:00.000Z
CVE-2008-6556 
cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T20:00:00.000Z
CVE-2008-6557 
cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the details command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T20:00:00.000Z
CVE-2008-6558 
Untrusted search path vulnerability in (1) hvdisp and (2) rcvm in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root privileges by modifying the RELIANT_PATH environment variable to point to a malicious bin/hvenv program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T20:00:00.000Z
CVE-2008-6559 
Merge mcd in ReliantHA 1.1.4 in SCO UnixWare 7.1.4 allows local users to gain root privileges via a crafted -d argument that contains .. (dot dot) sequences that point to a directory containing a file whose name includes shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-30T20:00:00.000Z
CVE-2008-6560 
Buffer overflow in CMAN - The Cluster Manager before 2.03.09-1 on Fedora 9 and Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (CPU consumption and memory corruption) via a cluster.conf file with many lines.  NOTE: it is not clear whether this issue crosses privilege boundaries in realistic uses of the product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T10:00:00.000Z
CVE-2008-6561 
Citrix Presentation Server Client for Windows before 10.200 does not clear "credential information" from process memory in unspecified circumstances, which might allow local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6562 
Cross-site scripting (XSS) vulnerability in jax_linklists.php in Jack (tR) Jax LinkLists 1.00 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6563 
Buffer overflow in the XML parser in Trillian 3.1.9.0, and possibly earlier, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DTD file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6564 
Nortel UNIStim protocol, as used in Communication Server 1000 and other products, uses predictable sequence numbers, which allows remote attackers to hijack sessions via sniffing or brute force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6565 
Cross-site scripting (XSS) vulnerability in Invision Power Board 2.3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via an IFRAME tag in the signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6566 
Unspecified vulnerability in Octopussy before 0.9.5.8 has unknown impact and attack vectors related to a "major security" vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6567 
Multiple cross-site scripting (XSS) vulnerabilities in Gallarific Free Edition allow remote attackers to inject arbitrary web script or HTML via (1) the e-mail address, (2) a comment, which is not properly handled during moderation, and (3) the tag parameter to gallery/tags.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6568 
Unrestricted file upload vulnerability in Yehe 2.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the envoyer feature.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6569 
Session fixation vulnerability in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to hijack web sessions via the session ID in the login page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6570 
Cross-site scripting (XSS) vulnerability in the RSS reader in Cybozu Garoon 2.0.0 through 2.1.3 allows remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6571 
Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before 1.3.4 might allow remote attackers to inject arbitrary web script or HTML via (1) new_images.php, (2) login.php, and unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T17:00:00.000Z
CVE-2008-6572 
SQL injection vulnerability in search_results.php in ABK-Soft AbleDating 2.4 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-31T22:00:00.000Z
CVE-2008-6573 
Multiple SQL injection vulnerabilities in Avaya SIP Enablement Services (SES) in Avaya Avaya Communication Manager 3.x, 4.0, and 5.0 (1) allow remote attackers to execute arbitrary SQL commands via unspecified vectors related to profiles in the SIP Personal Information Manager (SPIM) in the web interface; and allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to (2) permissions for SPIM profiles in the web interface and (3) a crafted SIP request to the SIP server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T22:00:00.000Z
CVE-2008-6574 
Unspecified vulnerability in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote attackers to gain privileges and cause a denial of service via unknown vectors related to reuse of valid credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T22:00:00.000Z
CVE-2008-6575 
Unspecified vulnerability in the SIP server in SIP Enablement Services (SES) in Avaya Communication Manager 3.1.x and 4.x allows remote authenticated users to cause a denial of service (resource consumption) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T22:00:00.000Z
CVE-2008-6576 
Unspecified vulnerability in the "session limitation technique" in the FTP service on Nortel Communications Server 1000 (CS1K) 4.50.x, when running on VGMC or signaling nodes, allows remote attackers to cause a denial of service (resource exhaustion and failed updates) via unknown vectors that causes consumption of all available sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T22:00:00.000Z
CVE-2008-6577 
Nortel MG1000S, Signaling Server, and Call Server on the Communications Server 1000 (CS1K) 4.50.x contain multiple unspecified hard-coded accounts and passwords, which allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T22:00:00.000Z
CVE-2008-6578 
Multiple unspecified vulnerabilities in Nortel Communication Server 1000 4.50.x allow remote attackers to execute arbitrary commands to gain privileges, obtain sensitive information, or cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T22:00:00.000Z
CVE-2008-6579 
Nortel Communication Server 1000 4.50.x allows remote attackers to obtain Web application structure via unknown vectors related to "web resources to phones and administrators."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T22:00:00.000Z
CVE-2008-6580 
The Red_Reservations script for ColdFusion stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database via a direct request to (1) makered.mdb and (2) makered97.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-02T15:00:00.000Z
CVE-2008-6581 
login.php in PhpAddEdit 1.3 allows remote attackers to bypass authentication and gain administrative access by setting the addedit cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-02T15:00:00.000Z
CVE-2008-6582 
SQL injection vulnerability in index.php in Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-02T15:00:00.000Z
CVE-2008-6583 
Buffer overflow in BS.player 2.27 build 959 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .SRT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6584 
html/index.php in TorrentFlux 2.3 allows remote authenticated users to execute arbitrary code via a URL with a file containing an executable extension in the url_upload parameter, which is downloaded by TorrentFlux and can be accessed via a direct request in a html/downloads/ user directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6585 
Cross-site request forgery (CSRF) vulnerability in html/admin.php in TorrentFlux 2.3 allows remote attackers to hijack the authentication of administrators for requests that add new accounts via the addUser action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6586 
Cross-site request forgery (CSRF) vulnerability in gui/index.php in µTorrent (uTorrent) WebUI 0.315 allows remote attackers to (1) hijack the authentication of users for requests that force the download of arbitrary torrent files via the add-url action and (2) hijack the authentication of administrators for requests that modify the administrator account via the setsetting action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6587 
Cross-site request forgery (CSRF) vulnerability in index.tmpl in Vuze (formerly Azureus HTML WebUI), probably 0.7.6, allows remote attackers to hijack the authentication of users for requests that force the download of arbitrary torrent files via the upurl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6588 
Aztech ADSL2/2+ 4-port router has a default "isp" account with a default "isp" password, which allows remote attackers to obtain access if this default is not changed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6589 
Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) index.php and (2) LightNEasy.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6590 
Multiple directory traversal vulnerabilities in LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allow remote attackers to read arbitrary files via a .. (dot dot) in the page parameter to (1) index.php and (2) LightNEasy.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6591 
LightNEasy "no database" (aka flat) version 1.2.2, and possibly SQLite version 1.2.2, allows remote attackers to create arbitrary files via the page parameter to (1) index.php and (2) LightNEasy.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6592 
thumbsup.php in Thumbs-Up 1.12, as used in LightNEasy "no database" (aka flat) and SQLite 1.2.2 and earlier, allows remote attackers to copy, rename, and read arbitrary files via directory traversal sequences in the image parameter with a modified cache_dir parameter containing a %00 (encoded null byte).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6593 
SQL injection vulnerability in LightNEasy/lightneasy.php in LightNEasy SQLite 1.2.2 and earlier allows remote attackers to inject arbitrary PHP code into comments.dat via the dlid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6594 
SQL injection vulnerability in the cm_rdfexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6595 
SQL injection vulnerability in the pmk_rssnewsexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6596 
SQL injection vulnerability in admin/index.php in PHCDownload 1.1 allows remote attackers to execute arbitrary SQL commands via the hash parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6597 
Cross-site scripting (XSS) vulnerability in upload/install/index.php in PHCDownload 1.1 allows remote attackers to inject arbitrary web script or HTML via the step parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6598 
Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6599 
cookiecheck.php in CookieCheck 1.0 stores tmp/cc_sessions under the web root with insufficient access control, which allows remote attackers to obtain session data via a direct request related to the "default session save path."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6600 
Cross-site scripting (XSS) vulnerability in the search feature in XMLPortal 3.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6601 
Unspecified vulnerability in Epona 1.5rc3 allows remote attackers to obtain the real IP address of users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6602 
Unspecified vulnerability in Download Center Lite before 2.1 has unknown impact and attack vectors related to "A minor security fix."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6603 
MoinMoin 1.6.2 and 1.7 does not properly enforce ACL checks when acl_hierarchic is set to True, which might allow remote attackers to bypass intended access restrictions, a different vulnerability than CVE-2008-1937.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-03T18:00:00.000Z
CVE-2008-6604 
Directory traversal vulnerability in index.php in PicoFlat CMS 0.5.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pagina parameter, a different vulnerability than CVE-2007-5390.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-04T22:00:00.000Z
CVE-2008-6605 
Cross-site request forgery (CSRF) vulnerability in the xslt script in the web-based management interface on the 2wire 1701HG, 1800HW, 2071HG, and 2700HG with firmware 3.17.5, 3.7.1, 4.25.19, or 5.29.51 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that cause a denial of service (network outage) via a page parameter with a % (percent) character followed by a non-alphanumeric character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T14:00:00.000Z
CVE-2008-6606 
SQL injection vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T14:00:00.000Z
CVE-2008-6607 
Cross-site scripting (XSS) vulnerability in view.php in MatPo Link 1.2 Beta allows remote attackers to inject arbitrary web script or HTML via the thema parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T14:00:00.000Z
CVE-2008-6608 
Multiple SQL injection vulnerabilities in DevelopItEasy Events Calendar 1.2 allow remote attackers to execute arbitrary SQL commands via (1) the user_name parameter (aka user field) to admin/index.php, (2) the user_pass parameter (aka pass field) to admin/index.php, or (3) the id parameter to calendar_details.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T14:00:00.000Z
CVE-2008-6609 
Cross-site scripting (XSS) vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2 allows remote attackers to inject arbitrary web script or HTML via the path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T16:00:00.000Z
CVE-2008-6610 
Absolute path traversal vulnerability in phpcksec.php in Stefan Ott phpcksec 0.2.0 allows remote attackers to list arbitrary directories and read arbitrary files via a full pathname in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T16:00:00.000Z
CVE-2008-6611 
SQL injection vulnerability in index.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T16:00:00.000Z
CVE-2008-6612 
Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T16:00:00.000Z
CVE-2008-6613 
uploader.php in minimal-ablog 0.4 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T16:00:00.000Z
CVE-2008-6614 
Multiple SQL injection vulnerabilities in microcms-admin-login.php in Implied By Design (IBD) Micro CMS 3.5 (aka 0.3.5) allow remote attackers to execute arbitrary SQL commands via (1) the administrators_username parameter (aka the Username field) or (2) the administrators_pass parameter (aka the Password field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-06T18:00:00.000Z