rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-0438 
Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode (IMG) are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to (1) admin/admin_users.php and (2) modcp.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-06T22:00:00.000Z
CVE-2006-0439 
Text Rider 2.4 stores sensitive data in the data directory under the web document root with insufficient access control, which allows remote attackers to obtain usernames and password hashes by directly accessing data/userlist.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2006-0440 
Text Rider 2.4 allows attackers to bypass authentication and upload files without providing a valid password by obtaining the MD5 hash of the password (possibly via another vulnerability that reads it from a data file), then including the hash in a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2006-0441 
Stack-based buffer overflow in Sami FTP Server 2.0.1 allows remote attackers to execute arbitrary code via a long USER command, which triggers the overflow when the log is viewed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2006-0442 
Multiple cross-site scripting (XSS) vulnerabilities in usercp.php in MyBulletinBoard (MyBB) 1.02 allow remote attackers to inject arbitrary web script or HTML via the (1) notepad parameter in a notepad action and (2) signature parameter in an editsig action. NOTE: These are different attack vectors, and probably a different vulnerability, than CVE-2006-0218 and CVE-2006-0219.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2006-0443 
Cross-site scripting (XSS) vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) realname and (2) comment parameters, or (3) via a javascript URI in the url parameter, when adding a comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2006-0444 
SQL injection vulnerability in index.php in Phpclanwebsite (aka PCW) 1.23.1 allows remote attackers to execute arbitrary SQL commands via the (1) par parameter in the post function on the forum page and possibly the (2) poll_id parameter on the poll page.  NOTE: the poll_id vector can also allow resultant cross-site scripting (XSS) from an unquoted error message for invalid SQL syntax.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2006-0445 
index.php in Phpclanwebsite 1.23.1 allows remote authenticated users to obtain the installation path by specifying an invalid file name to the uploader page, as demonstrated by "\", which will display the full path of uploader.php.  NOTE: this might be the result of a file inclusion vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-26T22:00:00.000Z
CVE-2006-0446 
Unspecified vulnerability in WeBWorK 2.1.3 and 2.2-pre1 allows remote privileged attackers to execute arbitrary commands as the web server via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T00:00:00.000Z
CVE-2006-0447 
Multiple buffer overflows in E-Post Mail Server 4.10 and SPA-PRO Mail @Solomon 4.00 allow remote attackers to execute arbitrary code via a long username to the (1) AUTH PLAIN or (2) AUTH LOGIN SMTP commands, which is not properly handled by (a) EPSTRS.EXE or (b) SPA-RS.EXE; (3) a long username in the APOP POP3 command, which is not properly handled by (c) EPSTPOP4S.EXE or (d) SPA-POP3S.EXE; (4) a long IMAP DELETE command, which is not properly handled by (e) EPSTIMAP4S.EXE or (f) SPA-IMAP4S.EXE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T00:00:00.000Z
CVE-2006-0448 
Multiple directory traversal vulnerabilities in (1) EPSTIMAP4S.EXE and (2) SPA-IMAP4S.EXE in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allow remote attackers to (a) list arbitrary directories or cause a denial of service via the LIST command; or create arbitrary files via the (b) APPEND, (c) COPY, or (d) RENAME commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T00:00:00.000Z
CVE-2006-0449 
Early termination vulnerability in the IMAP service in E-Post Mail 4.05 and SPA-PRO Mail 4.05 allows remote attackers to cause a denial of service (infinite loop) by sending an APPEND command and disconnecting before the expected amount of data is sent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T00:00:00.000Z
CVE-2006-0450 
phpBB 2.0.19 and earlier allows remote attackers to cause a denial of service (application crash) by (1) registering many users through profile.php or (2) using search.php to search in a certain way that confuses the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T00:00:00.000Z
CVE-2006-0451 
Multiple memory leaks in the LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (memory consumption) via invalid BER packets that trigger an error, which might prevent memory from being freed if it was allocated during the ber_scanf call, as demonstrated using the ProtoVer LDAP test suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-14T22:00:00.000Z
CVE-2006-0452 
dn2ancestor in the LDAP component in Fedora Directory Server 1.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via a ModDN operation with a DN that contains a large number of "," (comma) characters, which results in a large amount of recursion, as demonstrated using the ProtoVer LDAP test suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-14T22:00:00.000Z
CVE-2006-0453 
The LDAP component in Fedora Directory Server 1.0 allow remote attackers to cause a denial of service (crash) via a certain "bad BER sequence" that results in a free of uninitialized memory, as demonstrated using the ProtoVer LDAP test suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-14T22:00:00.000Z
CVE-2006-0454 
Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-07T18:00:00.000Z
CVE-2006-0455 
gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded.  Note: this also occurs when running the equivalent command "gpg --verify".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-15T22:00:00.000Z
CVE-2006-0456 
The strnlen_user function in Linux kernel before 2.6.16 on IBM S/390 can return an incorrect value, which allows local users to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-27T23:00:00.000Z
CVE-2006-0457 
Race condition in the (1) add_key, (2) request_key, and (3) keyctl functions in Linux kernel 2.6.x allows local users to cause a denial of service (crash) or read sensitive kernel memory by modifying the length of a string argument between the time that the kernel calculates the length and when it copies the data into kernel memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-14T02:00:00.000Z
CVE-2006-0458 
The DCC ACCEPT command handler in irssi before 0.8.9+0.8.10rc5-0ubuntu4.1 in Ubuntu Linux, and possibly other distributions, allows remote attackers to cause a denial of service (application crash) via certain crafted arguments in a DCC command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-06T23:00:00.000Z
CVE-2006-0459 
flex.skl in Will Estes and John Millaway Fast Lexical Analyzer Generator (flex) before 2.5.33 does not allocate enough memory for grammars containing (1) REJECT statements or (2) trailing context rules, which causes flex to generate code that contains a buffer overflow that might allow context-dependent attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-03-29T23:00:00.000Z
CVE-2006-0460 
Multiple buffer overflows in BomberClone before 0.11.6.2 allow remote attackers to execute arbitrary code via long error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-17T01:00:00.000Z
CVE-2006-0461 
Cross-site scripting (XSS) vulnerability in core.input.php in ExpressionEngine 1.4.1 allows remote attackers to inject arbitrary web script or HTML via HTTP_REFERER (referer).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2006-0462 
SQL injection vulnerability in comentarios.php in AndoNET Blog 2004.09.02 allows remote attackers to execute arbitrary SQL commands via the entrada parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2006-0463 
Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2006-0464 
Multiple SQL injection vulnerabilities in index.php in IdeoContent Manager allow remote attackers to execute arbitrary SQL commands via the (1) goto_id or (2) mid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2006-0465 
Cross-site scripting (XSS) vulnerability in risultati_ricerca.php in active121 Site Manager allows remote attackers to inject arbitrary web script or HTML via the cerca parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2006-0466 
Cross-site scripting (XSS) vulnerability in search.asp in Goldstag Content Management System allows remote attackers to inject arbitrary web script or HTML via the text parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-27T23:00:00.000Z
CVE-2006-0467 
Unspecified vulnerability in Pioneers (formerly gnocatan) before 0.9.49 allows remote attackers to cause a denial of service (application crash) via long chat messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T02:00:00.000Z
CVE-2006-0468 
CommuniGate Pro Core Server before 5.0.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via LDAP messages with negative BER lengths, and possibly other vectors, as demonstrated by the ProtoVer LDAP test suite.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-30T18:00:00.000Z
CVE-2006-0469 
Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in the SRC attribute of an IMG tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-30T18:00:00.000Z
CVE-2006-0470 
Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0471 
Cross-site scripting (XSS) vulnerability in the bbcode function in functions.php in my little homepage my little forum, as last modified in June 2005, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0472 
Cross-site scripting (XSS) vulnerability in guestbook.php in my little homepage my little guestbook, as last modified in March 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0473 
Cross-site scripting (XSS) vulnerability in the bbcode function in weblog.php in my little homepage my little weblog, as last modified in April 2004, allows remote attackers to inject arbitrary Javascript via a javascript URI in BBcode link tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0474 
Multiple integer overflows in Shareaza 2.2.1.0 allow remote attackers to execute arbitrary code via (1) a large packet length field, which causes an overflow in the ReadBuffer function in (a) BTPacket.cpp and (b) EDPacket.cpp, or (2) a large packet, which causes a heap-based overflow in the Write function in (c) Packet.h.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0475 
PHP-Ping 1.3 does not properly validate ping counts, which allows remote attackers to cause a denial of service (ping flood) via a negative count parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0476 
Buffer overflow in Nullsoft Winamp 5.12 allows remote attackers to execute arbitrary code via a playlist (pls) file with a long file name (File1 field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0477 
Buffer overflow in git-checkout-index in GIT before 1.1.5 allows remote attackers to execute arbitrary code via an index file with a long symbolic link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0478 
CRE Loaded 6.15 allows remote attackers to perform privileged actions, including uploading and creating arbitrary files, via a direct request to files.php.  NOTE: the vendor states "The initial announcement of this risk was made on our website... and it included a patch which will close the vulnerability on all known 6.0x and 6.1x releases.  We strongly encourage users of CRE Loaded 6.x, osCMax, and other users of osCommerce who have installed HTMLArea based WYSIWYG editors and Admin Access with Levels to modify thier installations at the earliest possible moment."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0479 
pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GPC variable and a GLOBALS[] variable with the same name, which causes PmWiki to unset the GLOBALS[] variable but not the GPC variable, which creates resultant vulnerabilities such as remote file inclusion and cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0480 
Cross-site scripting (XSS) vulnerability in the Articles module in sPaiz-Nuke allows remote attackers to inject arbitrary web script or HTML via the query parameter in the search file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T11:00:00.000Z
CVE-2006-0481 
Heap-based buffer overflow in the alpha strip capability in libpng 1.2.7 allows context-dependent attackers to cause a denial of service (crash) when the png_do_strip_filler function is used to strip alpha channels out of the image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T18:00:00.000Z
CVE-2006-0482 
Linux kernel 2.6.15.1 and earlier, when running on SPARC architectures, allows local users to cause a denial of service (hang) via a "date -s" command, which causes invalid sign extended arguments to be provided to the get_compat_timespec function call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T19:00:00.000Z
CVE-2006-0483 
Cisco VPN 3000 series concentrators running software 4.7.0 through 4.7.2.A allow remote attackers to cause a denial of service (device reload or user disconnect) via a crafted HTTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T20:00:00.000Z
CVE-2006-0484 
Directory traversal vulnerability in Vis.pl, as part of the FACE CONTROL product, allows remote attackers to read arbitrary files via a .. (dot dot) in any parameter that opens a file, such as (1) s or (2) p.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-01-31T20:00:00.000Z
CVE-2006-0485 
The TCL shell in Cisco IOS 12.2(14)S before 12.2(14)S16, 12.2(18)S before 12.2(18)S11, and certain other releases before 25 January 2006 does not perform Authentication, Authorization, and Accounting (AAA) command authorization checks, which may allow local users to execute IOS EXEC commands that were prohibited via the AAA configuration, aka Bug ID CSCeh73049.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0486 
Certain Cisco IOS releases in 12.2S based trains with maintenance release number 25 and later, 12.3T based trains, and 12.4 based trains reuse a Tcl Shell process across login sessions of different local users on the same terminal if the first user does not use tclquit before exiting, which may cause subsequent local users to execute unintended commands or bypass AAA command authorization checks, aka Bug ID CSCef77770.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0487 
Multiple unspecified vulnerabilities in Tumbleweed MailGate Email Firewall (EMF) 6.x allow remote attackers to (1) trigger temporarily incorrect processing of an e-mail message under "extremely heavy loads" and (2) cause an "increased number of missed spam" during "spam outbreaks."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0488 
The VDM (Virtual DOS Machine) emulation environment for MS-DOS applications in Windows 2000, Windows XP SP2, and Windows Server 2003 allows local users to read the first megabyte of memory and possibly obtain sensitive information, as demonstrated by dumper.asm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0489 
Buffer overflow in the font command of mIRC, probably 6.16, allows local users to execute arbitrary code via a long string. NOTE: the original researcher claims that issue has been disputed by the vendor, and that the vendor stated "as far as I can tell, this is neither an exploit nor a vulnerability.  The above report describes a local bug in mIRC."  It could be that this is only exploitable by the user of the application, and thus would not cross privilege boundaries unless under an otherwise restrictive environment such as a kiosk
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0490 
SQL injection vulnerability in login.asp in ASPThai.Net ASPThai Forums 8.0 and earlier allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0491 
SQL injection vulnerability in SZUserMgnt.class.php in SZUserMgnt 1.4 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0492 
Multiple SQL injection vulnerabilities in Calendarix allow remote attackers to execute arbitrary SQL commands via (1) the catview parameter in cal_functions.inc.php and (2) the login parameter in cal_login.php.  NOTE: the catview vector might overlap CVE-2005-1865.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0493 
Cross-site scripting (XSS) vulnerability in MG2 (formerly known as Minigal) 0.5.1 allows remote attackers to inject arbitrary web script or HTML via the Name field in a comment associated with a picture.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0494 
Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.02 allows local users with MyBB administrative privileges to include and possibly execute arbitrary local files via directory traversal sequences and a nul (%00) character in the plugin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0495 
Cross-site scripting (XSS) vulnerability in the Add Thread to Favorites feature in usercp2.php in MyBB (aka MyBulletinBoard) 1.02 allows remote attackers to inject arbitrary web script or HTML via an HTTP Referer header ($url variable).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0496 
Cross-site scripting (XSS) vulnerability in Mozilla 1.7.12 and possibly earlier, Mozilla Firefox 1.0.7 and possibly earlier, and Netscape 8.1 and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the -moz-binding (Cascading Style Sheets) CSS property, which does not require that the style sheet have the same origin as the web page, as demonstrated by the compromise of a large number of LiveJournal accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T02:00:00.000Z
CVE-2006-0497 
Multiple SQL injection vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary SQL commands via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2006-0498 
Multiple cross-site scripting (XSS) vulnerabilities in PHP GEN before 1.4 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T20:00:00.000Z
CVE-2006-0499 
Cross-site scripting (XSS) vulnerability in rlink.php in Rlink 1.0.0 module for phpBB allows remote attackers to inject arbitrary web script or HTML via the url parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T22:00:00.000Z