rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-2304 
Multiple integer overflows in the DPRPC library (DPRPCW32.DLL) in Novell Client 4.83 SP3, 4.90 SP2 and 4.91 SP2 allow remote attackers to execute arbitrary code via an XDR encoded array with a field that specifies a large number of elements, which triggers the overflows in the ndps_xdr_array function.  NOTE: this was originally reported to be a buffer overflow by Novell, but the original cause is an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-11T10:00:00.000Z
CVE-2006-2305 
Multiple cross-site scripting (XSS) vulnerabilities in Jadu CMS allow remote attackers to inject arbitrary web script or HTML via the (1) forename, (2) surname, (3) reg_email, (4) email_conf, (5) company, (6) city, (7) postcode, or (8) telephone parameters to site/scripts/register.php.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-11T10:00:00.000Z
CVE-2006-2306 
Cross-site scripting (XSS) vulnerability in moreinfo.asp in EPublisherPro allows remote attackers to inject arbitrary web script or HTML via the title parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-11T10:00:00.000Z
CVE-2006-2307 
Cross-site scripting (XSS) vulnerability in Website Baker CMS before 2.6.4 allows remote attackers to inject arbitrary web script or HTML via a user display name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-11T10:00:00.000Z
CVE-2006-2308 
Directory traversal vulnerability in the IMAP service in EServ/3 3.25 allows remote authenticated users to read other user's email messages, create/rename arbitrary directories on the system, and delete empty directories via directory traversal sequences in the (1) CREATE, (2) SELECT, (3) DELETE, (4) RENAME, (5) COPY or (6) APPEND commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T00:00:00.000Z
CVE-2006-2309 
The HTTP service in EServ/3 3.25 allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot, space, and slash characters, which reveals the source code of script files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T00:00:00.000Z
CVE-2006-2310 
BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to cause a denial of service (hang) via a request for a .cfm file whose name contains an MS-DOS device name such as (1) con, (2) aux, (3) com1, and (4) com2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-26T10:00:00.000Z
CVE-2006-2311 
Cross-site scripting (XSS) vulnerability in BlueDragon Server and Server JX 6.2.1.286 for Windows allows remote attackers to inject arbitrary web script or HTML via the filename in a request to a (1) .cfm or (2) .cfml file, which reflects the result in the default error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-26T10:00:00.000Z
CVE-2006-2312 
Argument injection vulnerability in the URI handler in Skype 2.0.*.104 and 2.5.*.0 through 2.5.*.78 for Windows allows remote authorized attackers to download arbitrary files via a URL that contains certain command-line switches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-19T21:00:00.000Z
CVE-2006-2313 
PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications via invalid encodings of multibyte characters, aka one variant of "Encoding-Based SQL Injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T10:00:00.000Z
CVE-2006-2314 
PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-24T10:00:00.000Z
CVE-2006-2315 
PHP remote file inclusion vulnerability in session.inc.php in ISPConfig 2.2.2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the go_info[server][classes_root] parameter.  NOTE: the vendor has disputed this vulnerability, saying that session.inc.php is not under the web root in version 2.2, and register_globals is not enabled
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2316 
S24EvMon.exe in the Intel PROset/Wireless software, possibly 10.1.0.33, uses a S24EventManagerSharedMemory shared memory section with weak permissions, which allows local users to read or modify passwords or other data, or cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2317 
Unspecified vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to read arbitrary files under the web root via unspecified attack vectors related to the OpenTextFile method in Scripting.FileSystemObject.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2318 
Incomplete blacklist vulnerability in Ideal Science Ideal BB 1.5.4a and earlier allows remote attackers to upload and execute an ASP script via a ".asa" file, which bypasses the check for the ".asp" extension but is executable on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2319 
Ideal Science Ideal BB 1.5.4a and earlier does not properly check file extensions before permitting an upload, which allows remote attackers to upload and execute an ASP script via a 0x00 character before the ".asp" portion of the filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2320 
Multiple SQL injection vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to execute arbitrary SQL commands via multiple unspecified vectors related to stored procedure calls.  NOTE: due to lack of details from the researcher, it is not clear whether this overlaps CVE-2004-2209.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2321 
Multiple cross-site scripting (XSS) vulnerabilities in Ideal Science Ideal BB 1.5.4a and earlier allow remote attackers to inject arbitrary web script or HTML via unknown vectors.  NOTE: due to lack of details from the researcher, it is not clear whether this overlaps CVE-2004-2207.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2322 
The transparent proxy feature of the Cisco Application Velocity System (AVS) 3110 5.0 and 4.0 and earlier, and 3120 5.0.0 and earlier, has a default configuration that allows remote attackers to proxy arbitrary TCP connections, aka Bug ID CSCsd32143.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2323 
Multiple PHP remote file inclusion vulnerabilities in SmartISoft phpListPro 2.01 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the returnpath parameter in (1) editsite.php, (2) addsite.php, and (3) in.php.  NOTE: The config.php vector is already covered by CVE-2006-1749.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2324 
180solutions Zango downloads "required Adware components" without checking integrity or authenticity, which might allow context-dependent attackers to execute arbitrary code by subverting the DNS resolution of static.zangocash.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2325 
Cross-site scripting (XSS) vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to inject arbitrary web script or HTML via the read parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  Also, this issue might be resultant from directory traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2326 
Directory traversal vulnerability in index.php in OnlyScript.info Online Universal Payment System Script allows remote attackers to read arbitrary files via directory traversal sequences in the read parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2327 
Multiple integer overflows in the DPRPC library (DPRPCNLM.NLM) NDPS/iPrint module in Novell Distributed Print Services in Novell NetWare 6.5 SP3, SP4, and SP5 allow remote attackers to execute arbitrary code via an XDR encoded array with a field that specifies a large number of elements, which triggers the overflows in the ndps_xdr_array function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2328 
SQL injection vulnerability in lib/adodb/server.php in AngelineCMS 0.6.5 and earlier might allow remote attackers to execute arbitrary SQL commands via the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2329 
AngelineCMS 0.6.5 and earlier allow remote attackers to obtain sensitive information via a direct request for (1) adodb-access.inc.php, (2) adodb-ado.inc.php, (3) adodb-ado_access.inc, (4) adodb-ado_mssql.inc.php, (5) adodb-borland_ibase, (6) adodb-csv.inc.php, (7) adodb-db2.inc.php, (8) adodb-fbsql.inc.php, (9) adodb-firebird.inc.php, (10) adodb-ibase.inc.php, (11) adodb-informix.inc.php, (12) adodb-informix72.inc, (13) adodb-mssql.inc.php, (14) adodb-mssqlpo.inc.php, (15) adodb-mysql.inc.php, (16) adodb-mysqlt.inc.php, (17) adodb-oci8.inc.php, (18) adodb-oci805.inc.php, (19) adodb-oci8po.inc.php, and (20) adodb-odbc.inc.php, which reveal the path in various error messages; and via a direct request for the (21) lib/system/ directory and (22) possibly other lib/ directories, which provide a directory listing and "architecture view."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2330 
PHP-Fusion 6.00.306 and earlier, running under Apache HTTP Server 1.3.27 and PHP 4.3.3, allows remote authenticated users to upload files of arbitrary types using a filename that contains two or more extensions that ends in an assumed-valid extension such as .gif, which bypasses the validation, as demonstrated by uploading then executing an avatar file that ends in ".php.gif" and contains PHP code in EXIF metadata.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2331 
Multiple directory traversal vulnerabilities in PHP-Fusion 6.00.306 allow remote attackers to include and execute arbitrary local files via (1) a .. (dot dot) in the settings[locale] parameter in infusions/last_seen_users_panel/last_seen_users_panel.php, and (2) a ..  (dot dot) in the localeset parameter in setup.php.  NOTE: the vendor states that this issue might exist due to problems in third party local files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2332 
Mozilla Firefox 1.5.0.3 allows remote attackers to cause a denial of service via a web page with a large number of IMG elements in which the SRC attribute is a mailto URI.  NOTE: another researcher found that the web page caused a temporary browser slowdown instead of a crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2333 
Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.1 allow remote attackers to execute arbitrary SQL commands via the e-mail address when registering for a forum that requires e-mail verification, which is not properly handled in (1) usercp.php and (2) member.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2334 
The RtlDosPathNameToNtPathName_U API function in NTDLL.DLL in Microsoft Windows 2000 SP4 and XP SP2 does not properly convert DOS style paths with trailing spaces into NT style paths, which allows context-dependent attackers to create files that cannot be accessed through the expected DOS path or prevent access to other similarly named files in the same directory, which prevents those files from being detected or disinfected by certain anti-virus and anti-spyware software.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2335 
Jelsoft vBulletin accepts uploads of Cascading Style Sheets (CSS) and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed.  NOTE: the vendor was unable to reproduce this issue in 3.5.x.  NOTE: this issue might be due to direct static code injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2336 
SQL injection vulnerability in showthread.php in MyBB (aka MyBulletinBoard) 1.1.1 allows remote attackers to execute arbitrary SQL commands via the comma parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2337 
Directory traversal vulnerability in webcm in the D-Link DSL-G604T Wireless ADSL Router Modem allows remote attackers to read arbitrary files via an absolute path in the getpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2338 
PlaNet Concept plaNetStat 20050127 allows remote attackers to gain administrative privileges, and view and configure log files, via a direct request to the (1) admin.php or (2) settings.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T00:00:00.000Z
CVE-2006-2339 
SQL injection vulnerability in index.php in evoTopsites 2.x and evoTopsites Pro 2.x allows remote attackers to execute arbitrary SQL commands via the (1) cat_id and (2) id parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T01:00:00.000Z
CVE-2006-2340 
Cross-site scripting (XSS) vulnerability in PassMasterFlex and PassMasterFlexPlus (PassMasterFlex+) 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) password, or (3) User-Agent HTTP header in the Hack Log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T01:00:00.000Z
CVE-2006-2341 
The HTTP proxy in Symantec Gateway Security 5000 Series 2.0.1 and 3.0, and Enterprise Firewall 8.0, when NAT is being used, allows remote attackers to determine internal IP addresses by using malformed HTTP requests, as demonstrated using a get request without a space separating the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T01:00:00.000Z
CVE-2006-2342 
IBM WebSphere Application Server 6.0.2 before FixPack 3 allows remote attackers to bypass authentication for the Welcome Page via a request to the default context root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2343 
Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine OpManager 6.0 allows remote attackers to inject arbitrary web script or HTML via the searchTerm parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2344 
SQL injection vulnerability in inc/elementz.php in AliPAGER 1.5, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary SQL commands via the ubild parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2345 
Cross-site scripting (XSS) vulnerability in inc/elementz.php in AliPAGER 1.5 allows remote attackers to inject arbitrary web script or HTML via the ubild parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.  NOTE: this issue might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2346 
vpopmail 5.4.14 and 5.4.15, with cleartext passwords enabled, allows remote attackers to authenticate to an account that does not have a cleartext password set by using a blank password to (1) SMTP AUTH or (2) APOP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2347 
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to obtain the full path of the web server via "'" characters, and possibly other invalid values, in (1) the id parameter to form_grupo.html, or requests to the (2) archivos/ and (3) files/ directories.  NOTE: this issue might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2348 
Cross-site scripting (XSS) vulnerability in form_grupo.html in E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this issue might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2349 
E-Business Designer (eBD) 3.1.4 and earlier allows remote attackers to upload or modify arbitrary files, and execute arbitrary code, via a direct request to (1) common/html_editor/image_browser.upload.html, (2) common/html_editor/image_browser.html, or (3) common/html_editor/html_editor.html.  NOTE: this can also be used for cross-site scripting (XSS) attacks by uploading cascading style sheet (.CSS) files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-12T17:00:00.000Z
CVE-2006-2351 
Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2352 
Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via unknown vectors in (1) NmConsole/Tools.asp and (2) NmConsole/DeviceSelection.asp.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2353 
NmConsole/DeviceSelection.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to redirect users to other websites via the (1) sCancelURL and possibly (2) sRedirectUrl parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2354 
NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium generates different error messages in a way that allows remote attackers to enumerate valid usernames. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2355 
Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium allows remote attackers to obtain full path information via 404 error messages.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2356 
NmConsole/utility/RenderMap.asp in Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain sensitive information about network nodes via a modified nDeviceGroupID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2357 
Ipswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allows remote attackers to obtain source code for scripts via a trailing dot in a request to NmConsole/Login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2358 
Multiple cross-site scripting (XSS) vulnerabilities in various scripts in Web-Labs CMS allow remote attackers to inject arbitrary web script or HTML via (1) the search parameter and (2) unspecified fields related to e-mail alerts.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T10:00:00.000Z
CVE-2006-2359 
Cross-site scripting (XSS) vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to inject arbitrary web script or HTML via the id parameter.  NOTE: this issue might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T16:00:00.000Z
CVE-2006-2360 
SQL injection vulnerability in charts.php in the Chart mod for phpBB allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T16:00:00.000Z
CVE-2006-2361 
PHP remote file inclusion vulnerability in pafiledb_constants.php in Download Manager (mxBB pafiledb) integration, as used with phpBB, allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-05-15T16:00:00.000Z