rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-1596 
Multiple PHP remote file inclusion vulnerabilities in the NFN Address Book (com_nfn_addressbook) 0.4 component for Mambo and Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) components/com_nfn_addressbook/nfnaddressbook.php or (2) administrator/components/com_nfn_addressbook/nfnaddressbook.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1597 
Unclassified NewsBoard 1.6.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain (1) the board log via a direct request for logs/board-YYYY-MM-DD.log, (2) the mail and private message (PM) log via a direct request for logs/email-YY-MM-DD-HH-MM-SS.log, (3) the SQL error message log via a direct request for logs/error-YY-MM.log, and (4) the IP log via a direct request for logs/ip.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1598 
Stack-based buffer overflow in InterVations FileCOPA FTP Server 1.01 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by filecopa.tar by Immunity.  NOTE: some of these details are obtained from third party information.  NOTE: As of 20070322, this disclosure has no actionable information. However, since it is from a reliable researcher, it is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1599 
wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirect_to parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1600 
PHP remote file inclusion vulnerability in module.php in Digital Eye Gallery 1.1 Beta (aka 0.1.1b) allows remote attackers to execute arbitrary PHP code via a URL in the menu parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1601 
Directory traversal vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the order parameter.  NOTE: another researcher disputes this vulnerability, noting that the order variable is not used in any context that allows opening files
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1602 
SQL injection vulnerability in check_vote.php in Weekly Drawing Contest 0.0.1 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1603 
admin/contest.php in Weekly Drawing Contest 0.0.1 allows remote attackers to bypass authentication, and insert new contest information into a database, via a direct POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1604 
Multiple unrestricted file upload vulnerabilities in w-Agora (Web-Agora) allow remote attackers to upload and execute arbitrary PHP code (1) via a forum message with an attached file, which is stored under forums/hello/hello/notes/ or (2) by using browse_avatar.php to upload a file with a double extension, as demonstrated by .php.jpg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1605 
w-Agora (Web-Agora) allows remote attackers to obtain sensitive information via a request to rss.php with an invalid (1) site or (2) bn parameter, (3) a certain value of the site[] parameter, or (4) an empty value of the bn[] parameter; a request to index.php with a certain value of the (5) site[] or (6) sort[] parameter; (7) a request to profile.php with an empty value of the site[] parameter; or a request to search.php with (8) an empty value of the bn[] parameter or a certain value of the (9) pattern[] or (10) search_date[] parameter, which reveal the path in various error messages, probably related to variable type inconsistencies.  NOTE: the bn[] parameter to index.php is already covered by CVE-2007-0606.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1606 
Multiple cross-site scripting (XSS) vulnerabilities in w-Agora (Web-Agora) allow remote attackers to inject arbitrary web script or HTML via (1) the showuser parameter to profile.php, the (2) search_forum or (3) search_user parameter to search.php, or (4) the userid parameter to change_password.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1607 
search.php in w-Agora (Web-Agora) allows remote attackers to obtain potentially sensitive information via a ' (quote) value followed by certain SQL sequences in the (1) search_forum or (2) search_user parameter, which force a SQL error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1608 
CRLF injection vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.19 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a single CRLF sequence in a context that is not a valid multi-line header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1609 
Cross-site scripting (XSS) vulnerability in servlet/Spy in Dynamic Monitoring Services (DMS) in Oracle Application Server (OAS) 10g 10.1.2.0.0 allows remote attackers to inject arbitrary web script or HTML via the table parameter.  NOTE: This may be related to CVE-2002-0563.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1610 
Cross-site scripting (XSS) vulnerability in the RSS reader in Glue Software NewsGlue before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via a feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1611 
Cross-site scripting (XSS) vulnerability in the RSS reader in a certain SOURCENEXT product, probably IKANARI JIJYOU 1.0.0 and 1.0.1, allows remote attackers to inject arbitrary web script or HTML via the title of an article in a feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-22T23:00:00.000Z
CVE-2007-1612 
SQL injection vulnerability in index.php in Katalog Plyt Audio 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the kolumna parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1613 
Directory traversal vulnerability in view.php in MPM Chat 2.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the logi parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1614 
Stack-based buffer overflow in the zzip_open_shared_io function in zzip/file.c in ZZIPlib Library before 0.13.49 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1615 
SQL injection vulnerability in index.php in ScriptMagix Jokes 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1616 
SQL injection vulnerability in index.php in ScriptMagix Lyrics 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the recid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1617 
SQL injection vulnerability in index.php in ScriptMagix Recipes 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1618 
SQL injection vulnerability in index.php in ScriptMagix FAQ Builder 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1619 
SQL injection vulnerability in viewcomments.php in ScriptMagix Photo Rating 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the phid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1620 
Multiple PHP remote file inclusion vulnerabilities in PHP DB Designer 1.02 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) _SESSION[SITE_PATH] parameter to (a) wind/help.php or (b) wind/about.php, or the (2) _SESSION[DRIVER] parameter to (c) db/session.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1621 
PHP remote file inclusion vulnerability in templates/head.php in Active PHP Bookmark Notes (APB) 0.2.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the APB_SETTINGS[template_path] parameter.  NOTE: this issue might be related to CVE-2003-1254.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1622 
Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in the 2.1 series, allows remote authenticated users with theme privileges to inject arbitrary web script or HTML via the PATH_INFO in the administration interface, related to loose regular expression processing of PHP_SELF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T00:00:00.000Z
CVE-2007-1623 
Multiple cross-site scripting (XSS) vulnerabilities in realGuestbook 5.01, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) bg_color_1, (2) fs_menu, (3) fc_menu, (4) ff_menu, (5) bg_color_2, (6) fs_normal, (7) fc_normal, and (8) ff_normal parameters to welcome_admin.php; and possibly unspecified other parameters and files.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1624 
Multiple SQL injection vulnerabilities in realGuestbook 5.01 allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) homepage, and (4) text parameters to save_entry.php, as reachable through add_entry.php; and possibly other unspecified parameters and files.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1625 
Cross-site scripting (XSS) vulnerability in save_entry.php in realGuestbook 5.01 allows remote attackers to inject arbitrary web script or HTML via the homepage parameter, as reachable through add_entry.php.  NOTE: the original report stated that the vulnerability was in add_entry.php, which does not receive the input data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1626 
PHP remote file inclusion vulnerability in iframe.php in the iFrame Module for PHP-NUKE allows remote attackers to execute arbitrary PHP code via a URL in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1628 
Multiple PHP remote file inclusion vulnerabilities in Study planner (Studiewijzer) 0.15 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the SPL_CFG[dirroot] parameter to (1) service.alert.inc.php or (2) settings.ses.php in inc/; (3) db/mysql/db.inc.php; (4) integration/shortstat/configuration.php; (5) ali.class.php or (6) cat.class.php in methodology/traditional/class/; (7) cat_browse.inc.php, (8) chr_browse.inc.php, (9) chr_display.inc.php, or (10) dash_browse.inc.php in methodology/traditional/ui/inc/; (11) spl.webservice.php or (12) konfabulator/gateway_admin.php in ws/; or other unspecified files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1629 
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Photo Gallery allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1630 
SQL injection vulnerability in default.asp in ActiveWebSoftwares Active Link Engine allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1631 
PHP remote file inclusion vulnerability in signup.php in CLBOX 1.01 allows remote attackers to execute arbitrary PHP code via a URL in the header parameter.  NOTE: this issue has been disputed by a reliable third party, stating that header is defined through an include file before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1632 
Unspecified vulnerability in TYPOlight webCMS before 2.2 Build 5 has unknown impact and attack vectors related to a "major security hole."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1633 
Directory traversal vulnerability in bbcode_ref.php in the Giorgio Ciranni Splatt Forum 4.0 RC1 module for PHP-Nuke allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter, as demonstrated by injecting PHP sequences into an Apache HTTP Server log file, which is then included by bbcode_ref.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T21:00:00.000Z
CVE-2007-1634 
Variable extraction vulnerability in grab_globals.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote attackers to conduct SQL injection attacks via the _FILES[DB][tmp_name] parameter to print.php, which overwrites the $DB variable with dynamic variable evaluation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T22:00:00.000Z
CVE-2007-1635 
Static code injection vulnerability in admin/settings.php in Net Portal Dynamic System (NPDS) 5.10 and earlier allows remote authenticated users to inject arbitrary PHP code via the xtop parameter in a "ConfigSave" op to admin.php, which can later be accessed via a "Configure" op to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T22:00:00.000Z
CVE-2007-1636 
Directory traversal vulnerability in index.php in RoseOnlineCMS 3 B1 allows remote attackers to include arbitrary files via a .. (dot dot) sequence in the op parameter, as demonstrated by injecting PHP code into Apache log files via the URL and User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T22:00:00.000Z
CVE-2007-1637 
Multiple buffer overflows in the IMAILAPILib ActiveX control (IMailAPI.dll) in Ipswitch IMail Server before 2006.2 allow remote attackers to execute arbitrary code via the (1) WebConnect and (2) Connect members in the (a) IMailServer control; (3) Sync3 and (4) Init3 members in the (b) IMailLDAPService control; and the (5) SetReplyTo member in the (c) IMailUserCollection control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T22:00:00.000Z
CVE-2007-1638 
Multiple cross-site request forgery (CSRF) vulnerabilities in the check_csrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allow remote attackers to perform unauthorized actions as an arbitrary user via the (1) Projects, (2) Contacts, (3) Helpdesk, (4) Notes, (5) Search, (6) Mail, or (7) Filemanager module; the (9) summary page; or unspecified other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T23:00:00.000Z
CVE-2007-1639 
Unrestricted file upload vulnerability in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allows remote authenticated users to upload and execute arbitrary PHP code via a file with an executable extension, which is then accessed by the (1) calendar or (2) file management module, or possibly unspecified other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T23:00:00.000Z
CVE-2007-1640 
Multiple PHP remote file inclusion vulnerabilities in ClassWeb 2.03 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the BASE parameter to (1) language.php and (2) phpadmin/survey.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T23:00:00.000Z
CVE-2007-1641 
SQL injection vulnerability in index.php in PortailPHP 2.0 allows remote attackers to execute arbitrary SQL commands via the idnews parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-23T23:00:00.000Z
CVE-2007-1642 
Unspecified vulnerability in ManageEngine Firewall Analyzer allows remote authenticated users to "access any common file" via a direct URL request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1643 
Multiple PHP remote file inclusion vulnerabilities in LAN Management System (LMS) 1.8.9 Vala and earlier allow remote attackers to execute arbitrary PHP code via a URL in (1) the CONFIG[directories][userpanel_dir] parameter to userpanel.php or the (2) _LIB_DIR parameter to welcome.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1644 
The dynamic DNS update mechanism in the DNS Server service on Microsoft Windows does not properly authenticate clients in certain deployments or configurations, which allows remote attackers to change DNS records for a web proxy server and conduct man-in-the-middle (MITM) attacks on web traffic, conduct pharming attacks by poisoning DNS records, and cause a denial of service (erroneous name resolution).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1645 
Buffer overflow in FutureSoft TFTP Server 2000 on Microsoft Windows 2000 SP4 allows remote attackers to execute arbitrary code via a long request on UDP port 69.  NOTE: this issue might overlap CVE-2006-4781 or CVE-2005-1812.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1646 
Multiple cross-site scripting (XSS) vulnerabilities in SubHub 2.3.0 allow remote attackers to inject arbitrary web script or HTML via (1) the searchtext parameter to (a) /search, or the (2) message parameter to (b) /calendar or (c) /subscribe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1647 
Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session (sess_*) files in moodledata/sessions/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1648 
0irc 1345 build 20060823 allows remote attackers to cause a denial of service (application crash) by operating an IRC server that sends a long string to a client, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1649 
PHP 5.2.1 allows context-dependent attackers to read portions of heap memory by executing certain scripts with a serialized data input string beginning with S:, which does not properly track the number of input bytes being processed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1650 
pcapsipdump.cpp in pcapsipdump before 0.1.3 allows remote attackers to cause a denial of service (application crash) via a malformed SIP packet, which results in a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1651 
Cross-site request forgery (CSRF) vulnerability in OpenID allows remote attackers to restore the login session of a user on an OpenID enabled site via unspecified vectors related to an arbitrary remote web site and cached tokens, after the user has signed into an OpenID server, logged into the OpenID enabled site, and then logged out of the OpenID enabled site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1652 
OpenID allows remote attackers to forcibly log a user into an OpenID enabled site, divulge the user's personal information to this site, and add it site to the trusted sites list via a crafted web page, related to cached tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1653 
GlowWorm FW before 1.5.3b4 allows remote attackers to cause a denial of service (kernel panic) via certain DNS responses that trigger infinite recursion in TrueDNS packet parsing, as originally observed with certain login.yahoo.com responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1654 
Buffer overflow in the Ne7sshSftp::addOpenHandle function in ne7ssh_sftp.cpp in NetSieben SSH Library (ne7ssh) before 1.2.1 allows user-assisted remote SFTP servers to cause a denial of service (crash) or possibly execute arbitrary code via multiple file transfers, related to multiple open file handles in SFTP (1) put and (2) get operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1655 
Buffer overflow in the fun_ladd function in funmath.cpp in TinyMUX before 20070126 might allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors related to lists of numbers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z
CVE-2007-1656 
Multiple SQL injection vulnerabilities in index.php in Katalog Plyt Audio 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) fraza and (2) litera parameters, different vectors than CVE-2007-1612.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-24T00:00:00.000Z