rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-3469 
Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service (crash) via a format string instead of a date as the first parameter to the date_format function, which is later used in a formatted print call to display the error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-18T23:00:00.000Z
CVE-2006-3470 
The Dell Openmanage CD launches X11 and SSH daemons that do not require authentication, which allows remote attackers to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T19:00:00.000Z
CVE-2006-3471 
Microsoft Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) via a table with a frameset as a child, which triggers a null dereference, as demonstrated using the appendChild method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T19:00:00.000Z
CVE-2006-3472 
Microsoft Internet Explorer 6.0 and 6.0 SP1 allows remote attackers to cause a denial of service via an HTML page with an A tag containing a long title attribute.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3473 
CRLF injection vulnerability in form_mail Drupal Module before 1.8.2.2 allows remote attackers to inject e-mail headers, which facilitates sending spam messages, a different issue than CVE-2006-1225.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3474 
Multiple SQL injection vulnerabilities in Belchior Foundry vCard PRO allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to (a) gbrowse.php, (2) card_id parameter to (b) rating.php and (c) create.php, and the (3) event_id parameter to (d) search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3475 
Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the qb_path parameter to (1) index.php, (2) about.php, (3) contact.php, (4) delete.php, (5) faq.php, (6) features.php or (7) history.php, a different set of vectors than CVE-2006-2998.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3476 
Cross-site scripting (XSS) vulnerability in comments.php in PhpWebGallery 1.5.2 and earlier, and possibly 1.6.0, allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3477 
Unspecified vulnerability in the POP service in Stalker CommuniGate Pro 5.1c1 and earlier allows remote attackers to cause a denial of service (server crash) via unspecified vectors involving opening an empty inbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3478 
PHP remote file inclusion vulnerability in styles/default/global_header.php in MyPHP CMS 0.3 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the domain parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3479 
Cross-site request forgery (CSRF) vulnerability in the del_block function in modules/Admin/block.php in Nuked-Klan 1.7.5 and earlier and 1.7 SP4.2 allows remote attackers to delete arbitrary "blocks" via a link with a modified bid parameter in a del_block op on the block page in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3480 
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.10 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters involving the (1) getUserStateFromRequest function, and the (2) SEF and (3) com_messages modules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3481 
Multiple SQL injection vulnerabilities in Joomla! before 1.0.10 allow remote attackers to execute arbitrary SQL commands via unspecified parameters involving the (1) "Remember Me" function, (2) "Related Items" module, and the (3) "Weblinks submission".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3482 
Cross-site scripting (XSS) vulnerability in maillist.php in PHPMailList 1.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3483 
PHPMailList 1.8.0 stores sensitive information under the web document root iwth insufficient access control, which allows remote attackers to obtain email addresses of subscribers, configuration information, and the admin username and password via direct requests to (1) list.dat or (2) ml_config.dat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3484 
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) show_courses or (2) current_cat parameters to (a) admin/create_course.php, show_courses parameter to (b) users/create_course.php, (3) p parameter to (c) documentation/admin/, (4) forgot parameter to (d) password_reminder.php, (5) cat parameter to (e) users/browse.php, or the (6) submit parameter to admin/fix_content.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3485 
Multiple SQL injection vulnerabilities in AstroDog Press Some Chess 1.5-RC2 and earlier allow remote attackers to execute arbitrary SQL commands via unspecified vectors, possibly including the gameID parameter in board.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T20:00:00.000Z
CVE-2006-3486 
Off-by-one buffer overflow in the Instance_options::complete_initialization function in instance_options.cc in the Instance Manager in MySQL before 5.0.23 and 5.1 before 5.1.12 might allow local users to cause a denial of service (application crash) via unspecified vectors, which triggers the overflow when the convert_dirname function is called.  NOTE: the vendor has disputed this issue via e-mail to CVE, saying that it is only exploitable when the user has access to the configuration file or the Instance Manager daemon.  Due to intended functionality, this level of access would already allow the user to disrupt program operation, so this does not cross security boundaries and is not a vulnerability
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T21:00:00.000Z
CVE-2006-3487 
VirtuaStore 2.0 stores sensitive files under the web root with insufficient access control, which allows remote attackers to obtain local database information by directly accessing database/virtuastore.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3488 
Absolute path traversal vulnerability in administrador.asp in VirtuaStore 2.0 allows remote attackers to possibly read arbitrary directories or files via an absolute path with Windows drive letter in the Pasta parameter when link=util, acao=ftp, and acaba=sim.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3489 
F-Secure Anti-Virus 2003 through 2006 and other versions, Internet Security 2003 through 2006, and Service Platform for Service Providers 6.x and earlier allows remote attackers to bypass anti-virus scanning via a crafted filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3490 
F-Secure Anti-Virus 2003 through 2006 and other versions, Internet Security 2003 through 2006, and Service Platform for Service Providers 6.x and earlier does not scan files contained on removable media when "Scan network drives" is disabled, which allows remote attackers to bypass anti-virus controls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3491 
Stack-based buffer overflow in Kaillera Server 0.86 and earlier allows remote attackers to execute arbitrary code via a long nickname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3492 
The CORBA::ORBInvokeRec::set_answer_invoke function in orb.cc in MICO (Mico Is CORBA) 2.3.12 and earlier allows remote attackers to cause a denial of service (application crash) via a message with an incorrect "object key", which triggers an assert error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3493 
Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office 2003, 2002, and 2000, allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type.  NOTE: this issue was originally reported to allow code execution, but on 20060710 Microsoft stated that code execution is not possible, and the original researcher agrees.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3494 
Multiple cross-site scripting (XSS) vulnerabilities in Buddy Zone 1.0.1 allow remote attackers to inject arbitrary HTML and web script via the (1) cat_id parameter to (a) view_classifieds.php; (2) id parameter in (b) view_ad.php; (3) event_id parameter in (c) view_event.php, (d) delete_event.php, and (e) edit_event.php; and (4) group_id in (f) view_group.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-10T22:00:00.000Z
CVE-2006-3495 
AFP Server in Apple Mac OS X 10.3.9 and 10.4.7 stores reconnect keys in a world-readable file, which allows local users to obtain the keys and access files and folders of other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-02T16:00:00.000Z
CVE-2006-3496 
AFP Server in Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause denial of service (crash) via an invalid AFP request that triggers an unchecked error condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-02T16:00:00.000Z
CVE-2006-3497 
Unspecified vulnerability in the "compression state handling" in Bom for Apple Mac OS X 10.3.9 and 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Zip archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-02T16:00:00.000Z
CVE-2006-3498 
Stack-based buffer overflow in bootpd in the DHCP component for Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to execute arbitrary code via a crafted BOOTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-02T16:00:00.000Z
CVE-2006-3499 
The dynamic linker (dyld) in Apple Mac OS X 10.3.9 allows local users to obtain sensitive information via unspecified dynamic linker options that affect the use of standard error (stderr) by privileged applications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-3500 
The dynamic linker (dyld) in Apple Mac OS X 10.4.7 allows local users to execute arbitrary code via an "improperly handled condition" that leads to use of "dangerous paths," probably related to an untrusted search path vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-3501 
Integer overflow in ImageIO for Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Radiance image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-3502 
Unspecified vulnerability in ImageIO in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image that triggers a memory allocation failure that is not properly handled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-3503 
Integer overflow in ImageIO in Apple Mac OS X 10.4.7 allows user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a malformed GIF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-3504 
The Download Validation in LaunchServices for Apple Mac OS X 10.4.7 can identify certain HTML as "safe", which could allow attackers to execute Javascript code in local context when the "Open 'safe' files after downloading" option is enabled in Safari.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-3505 
WebKit in Apple Mac OS X 10.3.9 and 10.4.7 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTML document that causes WebKit to access an object that has already been deallocated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-03T01:00:00.000Z
CVE-2006-3506 
Buffer overflow in the Xsan Filesystem driver on Mac OS X 10.4.7 and OS X Server 10.4.7 allows local users with Xsan write access, to execute arbitrary code via unspecified vectors related to "processing a path name."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-08-21T19:00:00.000Z
CVE-2006-3507 
Multiple stack-based buffer overflows in the AirPort wireless driver on Apple Mac OS X 10.3.9 and 10.4.7 allow physically proximate attackers to execute arbitrary code by injecting crafted frames into a wireless network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-21T21:00:00.000Z
CVE-2006-3508 
Heap-based buffer overflow in the AirPort wireless driver on Apple Mac OS X 10.4.7 allows physically proximate attackers to cause a denial of service (crash), gain privileges, and execute arbitrary code via a crafted frame that is not properly handled during scan cache updates.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-21T21:00:00.000Z
CVE-2006-3509 
Integer overflow in the API for the AirPort wireless driver on Apple Mac OS X 10.4.7 might allow physically proximate attackers to cause a denial of service (crash) or execute arbitrary code in third-party wireless software that uses the API via crafted frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-21T21:00:00.000Z
CVE-2006-3510 
The Remote Data Service Object (RDS.DataControl) in Microsoft Internet Explorer 6 on Windows 2000 allows remote attackers to cause a denial of service (crash) via a series of operations that result in an invalid length calculation when using SysAllocStringLen, then triggers a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T22:00:00.000Z
CVE-2006-3511 
Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by setting the fonts property of the HtmlDlgSafeHelper object, which triggers a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T22:00:00.000Z
CVE-2006-3512 
Internet Explorer 6 on Windows XP allows remote attackers to cause a denial of service (crash) by setting the Enabled property of a DXTFilter ActiveX object to true, which triggers a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T22:00:00.000Z
CVE-2006-3513 
danim.dll in Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (application crash) by accessing the Data property of a DirectAnimation DAUserData object before it is initialized, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T23:00:00.000Z
CVE-2006-3514 
Multiple cross-site scripting (XSS) vulnerabilities in admin/actions.php in PHP-Blogger 2.2.5, and possibly earlier versions, allow remote attackers to execute arbitrary web script or HTML via the (1) name, (2) title, (3) news, (4) description, and (5) sitename parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T23:00:00.000Z
CVE-2006-3515 
SQL injection vulnerability in the loginADP function in ajaxp.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands and bypass authentication via the (1) username or (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T23:00:00.000Z
CVE-2006-3516 
Multiple SQL injection vulnerabilities in FreeHost allow remote attackers to execute arbitrary SQL commands via (1) readme parameter to FreeHost/misc.php or (2) index parameter to FreeHost/news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T23:00:00.000Z
CVE-2006-3517 
PHP remote file inclusion vulnerability in stats.php in RW::Download, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T23:00:00.000Z
CVE-2006-3518 
SQL injection vulnerability in SayfalaAltList.asp in Webvizyon Portal 2006 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T23:00:00.000Z
CVE-2006-3519 
Multiple cross-site scripting (XSS) vulnerabilities in The Banner Engine (tbe) 4.0 allow remote attackers to execute arbitrary web script or HTML via the (1) text parameter in a search action to (a) top.php, and the (2) adminpass or (3) adminlogin parameter to (b) signup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-11T23:00:00.000Z
CVE-2006-3520 
PHP remote file inclusion vulnerability in skins/advanced/advanced1.php in Sabdrimer Pro 2.2.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the pluginpath[0] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3521 
Multiple cross-site scripting (XSS) vulnerabilities in index/siteforge-bugs-action/proj.siteforge in SiteForge Collaborative Development Platform 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) _status, (2) _extra1, (3) _extra2, or (4) _extra3 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3522 
Cross-site scripting (XSS) vulnerability in Clearswift MIMEsweeper for Web before 5.1.15 Hotfix allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in an error message when trying to access a blocked web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3523 
Clearswift MIMEsweeper for Web before 5.1.15 Hotfix allows remote attackers to cause a denial of service (crash) via an encrypted archived .RAR file, which triggers a scan error and causes the Web Policy Engine service to terminate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3524 
Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3525 
SQL injection vulnerability in category.php in PHCDownload 1.0.0 Final and 1.0.0 Release Candidate 6 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3526 
Multiple cross-site scripting (XSS) vulnerabilities in guestbook.php in Sport-slo Advanced Guestbook 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) name and (2) form parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3527 
Multiple PHP remote file inclusion vulnerabilities in BosClassifieds Classified Ads allow remote attackers to execute arbitrary PHP code via a URL in the insPath parameter to (1) index.php, (2) recent.php, (3) account.php, (4) classified.php, or (5) search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3528 
Multiple PHP remote file inclusion vulnerabilities in Simpleboard Mambo module 1.1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the sbp parameter to (1) image_upload.php and (2) file_upload.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3529 
Memory leak in Juniper JUNOS 6.4 through 8.0, built before May 10, 2006, allows remote attackers to cause a denial of service (kernel packet memory consumption and crash) via crafted IPv6 packets whose buffers are not released after they are processed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T00:00:00.000Z
CVE-2006-3530 
PHP remote file inclusion vulnerability in com_pccookbook/pccookbook.php in the PccookBook Component for Mambo and Joomla 0.3 and possibly up to 1.3.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T21:00:00.000Z
CVE-2006-3531 
includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel indices of the (a) Pivot_Vars[] or (b) Users[] array parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T21:00:00.000Z
CVE-2006-3532 
PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a FTP URL or full file path in the Paths[extensions_path] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-12T21:00:00.000Z