rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-4313 
PHP remote file inclusion vulnerability in public_includes/pub_blocks/activecontent.php in Php Blue Dragon CMS 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the vsDragonRootPath parameter, a different vector than CVE-2006-2392, CVE-2006-3076, and CVE-2006-6958.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T21:00:00.000Z
CVE-2007-4314 
pixlie.php in Pixlie 1.7 allows remote attackers to trigger the reading and JPEG image processing of files in a remote directory tree via a URL in the root parameter.  NOTE: this can be leveraged for traffic amplification or other denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T21:00:00.000Z
CVE-2007-4315 
The AMD ATI atidsmxx.sys 3.0.502.0 driver on Windows Vista allows local users to bypass the driver signing policy, write to arbitrary kernel memory locations, and thereby gain privileges via unspecified vectors, as demonstrated by "Purple Pill".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T21:00:00.000Z
CVE-2007-4316 
The management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device has a certain default password, which allows remote attackers to perform administrative actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T21:00:00.000Z
CVE-2007-4317 
Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allow remote attackers to perform certain actions as administrators, as demonstrated by a request to Forms/General_1 with the (1) sysSystemName and (2) sysDomainName parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T21:00:00.000Z
CVE-2007-4318 
Cross-site scripting (XSS) vulnerability in Forms/General_1 in the management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administrators to inject arbitrary web script or HTML via the sysSystemName parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T21:00:00.000Z
CVE-2007-4319 
The management interface in ZyNOS firmware 3.62(WK.6) on the Zyxel Zywall 2 device allows remote authenticated administrators to cause a denial of service (infinite reboot loop) via invalid configuration data.  NOTE: this issue might not cross privilege boundaries, and it might be resultant from CSRF; if so, then it should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-13T21:00:00.000Z
CVE-2007-4320 
PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the adminfolder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4321 
fail2ban 0.8 and earlier does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a client protocol version identification containing an IP address string, a different vector than CVE-2006-6302.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4322 
BlockHosts before 2.0.4 does not properly parse (1) sshd and (2) vsftpd log files, which allows remote attackers to add arbitrary deny entries to the /etc/hosts.allow file and cause a denial of service by adding arbitrary IP addresses to a daemon log file, as demonstrated by connecting through ssh with a client protocol version identification containing an IP address string, or connecting through ftp with a username containing an IP address string, different vectors than CVE-2007-2765.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4323 
DenyHosts 2.6 does not properly parse sshd log files, which allows remote attackers to add arbitrary hosts to the /etc/hosts.deny file and cause a denial of service by adding arbitrary IP addresses to the sshd log file, as demonstrated by logging in via ssh with a client protocol version identification containing an IP address string, a different vector than CVE-2006-6301.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4324 
ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and other versions and other 9.0.124.0 and earlier versions, allows remote attackers to bypass the Security Sandbox Model, obtain sensitive information, and port scan arbitrary hosts via a Flash (SWF) movie that specifies a connection to make, then uses timing discrepancies from the SecurityErrorEvent error to determine whether a port is open or not.  NOTE: 9.0.115.0 introduces support for a workaround, but does not fix the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4325 
PHP remote file inclusion vulnerability in index.php in Gaestebuch 1.5 allows remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4326 
Multiple PHP remote file inclusion vulnerabilities in Bilder Uploader 1.3 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) gruppen.php, (2) bild.php, (3) feed.php, (4) mitglieder.php, (5) online.php, (6) profil.php, and possibly other unspecified PHP scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4327 
Multiple PHP remote file inclusion vulnerabilities in File Uploader 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php or (2) datei.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4328 
Multiple PHP remote file inclusion vulnerabilities in Mapos Bilder Galerie 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2) galerie.php, or (3) anzagien.php.  NOTE: A later report states that 1.1 is also affected, but that the filename for vector 3 is anzeigen.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4329 
Multiple PHP remote file inclusion vulnerabilities in Web News 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2) news.php, or (3) feed.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4330 
PHP remote file inclusion vulnerability in shoutbox.php in Shoutbox 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4331 
PHP remote file inclusion vulnerability in index.php in FindNix allows remote attackers to include the contents of arbitrary URLs and conduct cross-site scripting (XSS) attacks via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T00:00:00.000Z
CVE-2007-4332 
SQL injection vulnerability in article.php in Article Dashboard, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a print action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4333 
Multiple cross-site scripting (XSS) vulnerabilities in signup.php in Article Dashboard allow remote attackers to inject arbitrary web script or HTML via the (1) f_emailaddress, (2) f_reemailaddress, and other unspecified parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4334 
Cross-site scripting (XSS) vulnerability in whois.php in Php-stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the IP parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4335 
Format string vulnerability in the SMTP server component in Qbik WinGate 5.x and 6.x before 6.2.2 allows remote attackers to cause a denial of service (service crash) via format string specifiers in certain unexpected commands, which trigger a crash during error logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4336 
Buffer overflow in the Live Picture Corporation DXSurface.LivePicture.FlashPix.1 (DirectTransform FlashPix) ActiveX control in DXTLIPI.DLL 6.0.2.827, as packaged in Microsoft DirectX Media 6.0 SDK, allows remote attackers to execute arbitrary code via a long SourceUrl property value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4337 
Multiple buffer overflows in the httplib_parse_sc_header function in lib/http.c in Streamripper before 1.62.2 allow remote attackers to execute arbitrary code via long (1) Location and (2) Server HTTP headers, a different vulnerability than CVE-2006-3124.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4338 
index.php in Ryan Haudenschilt Family Connections (FCMS) before 0.9 allows remote attackers to access an arbitrary account by placing the account's name in the value of an fcms_login_id cookie.  NOTE: this can be leveraged for code execution via a POST with PHP code in the content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4339 
Multiple PHP remote file inclusion vulnerabilities in PHPCentral Poll Script 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter in (1) poll.php and (2) pollarchive.php.  NOTE: a reliable third party states that this issue is resultant from a variable extraction error in functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4340 
PHP remote file inclusion vulnerability in index.php in phpDVD 1.0.4 allows remote attackers to execute arbitrary PHP code via a URL in the dvd_config_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4341 
PHP remote file inclusion vulnerability in adm/my_statistics.php in Omnistar Lib2 PHP 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4342 
PHP remote file inclusion vulnerability in include.php in PHPCentral Login 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the _SERVER[DOCUMENT_ROOT] parameter.  NOTE: a third party disputes this vulnerability because of the special nature of the SERVER superglobal array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-14T18:00:00.000Z
CVE-2007-4343 
Stack-based buffer overflow in IrfanView 3.99 and 4.00 allows user-assisted remote attackers to execute arbitrary code via a crafted palette (.pal) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-16T23:00:00.000Z
CVE-2007-4344 
Multiple input validation errors in ACD ACDSee Photo Manager 9.0 build 108, Pro Photo Manager 8.1 build 99, and Photo Editor 4.0 build 195 allow user-assisted remote attackers to execute arbitrary code via a long section string in (1) a PSP image to the ID_PSP.apl plug-in or (2) an LHA archive to the AM_LHA.apl plug-in, resulting in a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-15T22:00:00.000Z
CVE-2007-4345 
Buffer overflow in IMail Client 9.22, as shipped with IPSwitch IMail Server 2006.22, allows remote attackers to execute arbitrary code via a long boundary parameter in a multipart MIME e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T17:00:00.000Z
CVE-2007-4346 
The Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allows remote attackers to cause a denial of service (NULL dereference and service crash) via a crafted packet to port 5633/tcp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-29T23:00:00.000Z
CVE-2007-4347 
Multiple integer overflows in the Job Engine (bengine.exe) service in Symantec Backup Exec for Windows Servers (BEWS) 11d build 11.0.7170 and 11.0.6.6235 allow remote attackers to cause a denial of service (CPU and memory consumption) via a crafted packet to port 5633/tcp, which triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-29T23:00:00.000Z
CVE-2007-4348 
Cross-site scripting (XSS) vulnerability in the CAD service in IBM Tivoli Storage Manager (TSM) Client 5.3.5.3 and 5.4.1.2 for Windows allows remote attackers to inject arbitrary web script or HTML via HTTP requests to port 1581, which generate log entries in a dsmerror.log file that is accessible through a certain web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-30T19:00:00.000Z
CVE-2007-4349 
The Shared Trace Service (aka OVTrace) in HP Performance Agent C.04.70 (aka 4.70), HP OpenView Performance Agent C.04.60 and C.04.61, HP Reporter 3.8, and HP OpenView Reporter 3.7 (aka Report 3.70) allows remote attackers to cause a denial of service via an unspecified series of RPC requests (aka Trace Event Messages) that triggers an out-of-bounds memory access, related to an erroneous object reference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-23T21:00:00.000Z
CVE-2007-4350 
Cross-site scripting (XSS) vulnerability in the management interface in HP SiteScope 9.0 build 911 allows remote attackers to inject arbitrary web script or HTML via an SNMP trap message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-21T16:00:00.000Z
CVE-2007-4351 
Off-by-one error in the ippReadIO function in cups/ipp.c in CUPS 1.3.3 allows remote attackers to cause a denial of service (crash) via a crafted (1) textWithLanguage or (2) nameWithLanguage Internet Printing Protocol (IPP) tag, leading to a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-31T22:00:00.000Z
CVE-2007-4352 
Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-11-08T02:00:00.000Z
CVE-2007-4353 
Multiple buffer overflows in IBM AIX 5.2 and 5.3 allow local users in the system group to gain root privileges via unspecified vectors involving the (1) chpath, (2) rmpath, and (3) devinstall programs in bos.rte.methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T00:00:00.000Z
CVE-2007-4354 
Buffer overflow in fileplace in bos.perf.tools in IBM AIX 5.2 and 5.3 allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T00:00:00.000Z
CVE-2007-4355 
Buffer overflow in the at program on IBM AIX 5.3 allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T00:00:00.000Z
CVE-2007-4356 
Microsoft Internet Explorer 6 and 7 embeds FTP credentials in HTML files that are retrieved during an FTP session, which allows context-dependent attackers to obtain sensitive information by reading the HTML source, as demonstrated by a (1) .htm, (2) .html, or (3) .mht file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T00:00:00.000Z
CVE-2007-4357 
Mozilla Firefox 2.0.0.6 and earlier allows remote attackers to spoof the contents of the status bar via a link to a data: URI containing an encoded URL.  NOTE: the severity of this issue has been disputed by a reliable third party, since the intended functionality of the status bar allows it to be modified.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T00:00:00.000Z
CVE-2007-4358 
Zoidcom 0.6.7 and earlier allows remote attackers to cause a denial of service (application crash) via a JOIN packet (aka connection packet) containing 0x69 in the ninth byte, which triggers a "double-delete" of trace data, a different vulnerability than CVE-2005-1643.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4359 
Multiple SQL injection vulnerabilities in SkilMatch Staffing Systems JobLister3 allow remote attackers to execute arbitrary SQL commands via (1) the search form or (2) the jobid parameter to index.php in a showbyID action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4360 
Unspecified vulnerability in Dell Remote Access Card 4 (DRAC4) with firmware 1.50 Build 02.16 allows remote attackers to cause a denial of service (SSH daemon crash) via certain network traffic, as demonstrated by an "nmap -O" scan with nmap 4.03, possibly related to a Mocana (Mocanada) SSH vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4361 
NETGEAR (formerly Infrant) ReadyNAS RAIDiator before 4.00b2-p2-T1 beta creates a default SSH root password derived from the hardware serial number, which makes it easier for remote attackers to guess the password and obtain login access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4362 
SQL injection vulnerability in category.php in Prozilla Webring allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4363 
Multiple cross-site scripting (XSS) vulnerabilities in the nodereference module in Drupal Content Construction Kit (CCK) before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote attackers to inject arbitrary web script or HTML via nodereference fields, when using (1) the plain formatter or (2) the autocomplete text field widget without Views.module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4364 
Fedora Commons before 2.2.1 does not properly handle certain authentication requests involving Java Naming and Directory Interface (JNDI), related to (1) a nonexistent account name in combination with an empty password, which allows remote attackers to trigger a certain "unexpected / strange response" from an LDAP server, and (2) a reauthentication attempt that throws an exception, which allows remote attackers to trigger use of a cached authentication decision.  NOTE: authentication can be bypassed by using vector 1 followed by vector 2, and possibly can be bypassed by using a single vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4365 
Cross-site scripting (XSS) vulnerability in eXV2 CMS 2.0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a set_lang cookie to an unspecified component.  NOTE: this may overlap CVE-2007-1965.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4366 
WengoPhone 2.1 allows remote attackers to cause a denial of service (device crash) via a SIP INVITE message without a Content-Type header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T19:00:00.000Z
CVE-2007-4367 
Opera before 9.23 allows remote attackers to execute arbitrary code via crafted Javascript that triggers a "virtual function call on an invalid pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T23:00:00.000Z
CVE-2007-4368 
SQL injection vulnerability in /main in IBM Rational ClearQuest (CQ) Web 7.0.0.0-IFIX02 and 7.0.0.1 allows remote attackers to execute arbitrary SQL commands via the username parameter in a GenerateMainFrame command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T23:00:00.000Z
CVE-2007-4369 
Directory traversal vulnerability in go/_files in SOTEeSKLEP before 4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T23:00:00.000Z
CVE-2007-4370 
Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long string to UDP port 26000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T23:00:00.000Z
CVE-2007-4371 
Unrestricted file upload vulnerability in admin/pages/blog-add.php in Neuron Blog 1.1 allows remote attackers to upload and execute arbitrary PHP files in uploads/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-15T23:00:00.000Z
CVE-2007-4372 
Unspecified vulnerability in NetWin SurgeMail 38k on Windows Server 2003 has unknown impact and remote attack vectors.  NOTE: this information is based upon a vague advisory by a vulnerability information sales organization that does not coordinate with vendors or release actionable advisories. A CVE has been assigned for tracking purposes, but duplicates with other CVEs are difficult to determine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4373 
The server in Babo Violent 2 2.08.00 and earlier does not properly implement password protection, which might allow remote attackers to bypass authentication by reconnecting after a connection closes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z
CVE-2007-4374 
Babo Violent 2 2.08.00 does not validate the sender field of a chat message composed by a client, which allows remote authenticated users to spoof messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-16T18:00:00.000Z