rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-7129 
XySSL before 0.9 allows remote attackers to cause a denial of service (infinite loop) via an X.509 certificate that does not pass the RSA signature check during verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7130 
Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to upload arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7131 
Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier allows remote attackers to gain access to a database via a link to a victim who is already connected to the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T10:00:00.000Z
CVE-2008-7132 
Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan 1.3 beta allows remote attackers to inject arbitrary web script or HTML via the nuked_nude parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7133 
Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org EasyImageCatalogue 1.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) search and (2) d index.php parameters to index.php, (3) dir parameter to thumber.php, and the d parameter to (4) describe.php and (5) addcomment.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7134 
Multiple cross-site scripting (XSS) vulnerabilities in the default URI in Chris LaPointe RedGalaxy Download Center 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter, (2) message parameter in a login action, (3) category parameter in a browse action, (4) now parameter, or (5) search parameter in a search_results action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7135 
toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the IsChecked method, a different vector than CVE-2008-7136.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7136 
toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers to cause a denial of service (toolbar crash) via a long argument to the (1) RequestURL, (2) GetPropertyById, or (3) SetPropertyById method, different vectors than CVE-2008-7135.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7137 
WS-Proxy in Eye-Fi 1.1.2 allows remote attackers to cause a denial of service (crash) via an empty query string to port 59278 and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7138 
The Manager in Eye-Fi 1.1.2 generates predictable snonce values based on the time of day, which allows remote attackers to bypass authentication and upload arbitrary images by guessing the snonce.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7139 
Multiple cross-site request forgery (CSRF) vulnerabilities in WS-Proxy in Eye-Fi 1.1.2 allow remote attackers to hijack the authentication of users for requests that modify configuration via a SOAPAction parameter of (1) urn:SetOptions for autostart, (2) urn:SetDesktopSync for file upload, or (3) urn:SetFolderConfig for file download location or modification of authentication credentials; and (4) urn:AddNetwork for adding an arbitrary Service Set Identifier (SSID) to hijack the image upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7140 
Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook 4.0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) language_setup parameter to setup.php or (2) test parameter to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: a third party has been reported that the test parameter is not used in @lex Guestbook.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7141 
Cross-site scripting (XSS) vulnerability in setup.php in @lex Poll 2.1 allows remote attackers to inject arbitrary web script or HTML via the language_setup parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7142 
Absolute path traversal vulnerability in the Disk Usage module (frontend/x/diskusage/index.html) in cPanel 11.18.3 allows remote attackers to list arbitrary directories via the showtree parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7143 
phpBB 2.0.23 includes the session ID in a request to modcp.php when the moderator or administrator closes a thread, which allows remote attackers to hijack the session via a post in the thread containing a URL to a remotely hosted image, which might include the session ID in the Referer header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7144 
Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have unknown impact and attack vectors related to crafted (1) ACE, (2) ARJ, (3) BZ2, (4) CAB, (5) GZ, (6) LHA, (7) RAR, (8) TAR, or (9) ZIP files, as demonstrated by the OUSPG PROTOS GENOME test suite for Archive Formats.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7145 
Multiple SQL injection vulnerabilities in index.php in CoronaMatrix phpAddressBook 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7146 
IntraLearn Software IntraLearn 2.1, and possibly other versions before 4.2.3, allows remote attackers to obtain sensitive information via a direct request to (1) Knowledge_Impact_Course.htm, (2) LRN-formatted_Course.htm, or (3) Create_Course.htm in help/1/Instructor/, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7147 
Multiple cross-site scripting (XSS) vulnerabilities in IntraLearn Software IntraLearn 2.1, and possibly other versions before 4.2.3, allow remote attackers to inject arbitrary web script or HTML via the (1) outline and (2) course parameters to library/description_link.cfm, or the (3) records_to_display and (4) the_start parameters to library/courses_catalog.cfm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7148 
Unspecified vulnerability in Synfig Animation Studio before 0.61.08 allows attackers to execute arbitrary code via a crafted .sif file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7149 
Unspecified vulnerability in AgileWiki before 0.10.1 has unknown impact and attack vectors related to passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7150 
Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refine_by_taxo when displaying tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7151 
Cross-site request forgery (CSRF) vulnerability in Live 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to hijack the authentication of unspecified privileged users for requests that can be leveraged to execute arbitrary PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7152 
Multiple PHP remote file inclusion vulnerabilities in Specimen Image Database (SID), when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the dir parameter to (1) client.php or (2) taxonservice.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-01T16:00:00.000Z
CVE-2008-7153 
SQL injection vulnerability in the autoDetectRegion function in doceboCore/lib/lib.regset.php in Docebo 3.5.0.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Accept-Language HTTP header.  NOTE: this can be leveraged to execute arbitrary PHP code using the INTO DUMPFILE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-02T17:00:00.000Z
CVE-2008-7154 
Docebo 3.5.0.3 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) class/class.conf_fw.php, (2) class.module/class.event_manager.php, (3) lib/lib.domxml5.php, or (4) menu/menu_over.php in doceboCore/; or (5) class/class.conf_cms.php, (6) lib/lib.compose.php, (7) modules/chat/teleskill.php, or (8) class/class.admin_menu_cms.php in doceboCms/; which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-02T17:00:00.000Z
CVE-2008-7155 
NetRisk 1.9.7 does not properly restrict access to admin/change_submit.php, which allows remote attackers to change the password of arbitrary users via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-02T17:00:00.000Z
CVE-2008-7156 
EkinBoard 1.1.0 and earlier, when register_globals is enabled, allows remote attackers to bypass authorization and gain administrator privileges by setting the _groups[] parameter to 2, as demonstrated via backup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-02T17:00:00.000Z
CVE-2008-7157 
Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading an avatar file with an executable extension followed by a safe extension, then accessing it via a direct request to the file in uploaded/avatars/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-02T17:00:00.000Z
CVE-2008-7158 
Numara FootPrints 7.5a through 7.5a1 and 8.0 through 8.0a allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) transcriptFile parameter to MRcgi/MRchat.pl or (2) LOADFILE parameter to MRcgi/MRABLoad2.pl.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-02T17:00:00.000Z
CVE-2008-7159 
The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.8 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted OID value, related to incorrect use of a %lu format string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2008-7160 
The silc_http_server_parse function in lib/silchttp/silchttpserver.c in the internal HTTP server in silcd in Secure Internet Live Conferencing (SILC) Toolkit before 1.1.9 allows remote attackers to overwrite a stack location and possibly execute arbitrary code via a crafted Content-Length header, related to incorrect use of a %lu format string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2008-7161 
Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 allows remote attackers to bypass URL filtering via fragmented GET or POST requests that use HTTP/1.0 without the Host header.  NOTE: this issue might be related to CVE-2005-3058.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T10:00:00.000Z
CVE-2008-7162 
Buffer overflow in Hero Super Player 3000 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long filename in a .M3U file.  NOTE: this might be related to CVE-2008-4504.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T10:00:00.000Z
CVE-2008-7163 
Directory traversal vulnerability in mods/Integrated/index.php in SineCMS 2.3.5 and earlier, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via the sine[config][index_main] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T10:00:00.000Z
CVE-2008-7164 
Multiple unspecified vulnerabilities in Shareaza before 2.3.1.0 have unknown impact and attack vectors related to "very important security fixes," possibly involving update notifications and a domain that is no longer controlled by the vendor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T10:00:00.000Z
CVE-2008-7165 
Cross-site request forgery in cp06_wifi_m_nocifr.cgi in the administrator panel in TELECOM ITALIA Alice Gate2 Plus Wi-Fi allows remote attackers to hijack the authentication of administrators for requests that disable Wi-Fi encryption via certain values for the wlChannel and wlRadioEnable parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T10:00:00.000Z
CVE-2008-7166 
Buffer overflow in the web interface in BitTorrent 6.0.1 (build 7859) and earlier, and uTorrent 1.7.6 (build 7859) and earlier, allows remote attackers to cause a denial of service (memory consumption and crash) via a crafted Range header.  NOTE: this is probably a different vulnerability than CVE-2008-0071 and CVE-2008-0364.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T10:00:00.000Z
CVE-2008-7167 
Unrestricted file upload vulnerability in upload.php in Page Manager 2006-02-04 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7168 
Insecure method vulnerability in the UUSee UUUpgrade ActiveX control (UUUpgrade.ocx 3.0.2.12) allows remote attackers to force the download and overwrite of arbitrary files via crafted arguments to the Update method, as exploited in the wild in June 2009.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7169 
SQL injection vulnerability in Jabode horoscope extension (com_jabode) for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a sign task to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7170 
GSC build 2067 and earlier relies on the client to enforce administrator privileges, which allows remote attackers to execute arbitrary administrator commands via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7171 
Multiple cross-site scripting (XSS) vulnerabilities in Lightweight news portal (LNP) 1.0b allow remote attackers to inject arbitrary web script or HTML via the (1) photo parameter to show_photo.php, (2) potd parameter to show_potd.php, or (3) the Current question field in a vote action to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7172 
Lightweight news portal (LNP) 1.0b does not properly restrict access to administrator functionality, which allows remote attackers to gain administrator privileges via direct requests to admin.php with the (1) potd_delete, (2) potd, (3) vote_update, (4) vote, or (5) modifynews actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7173 
The Jura Internet Connection Kit for the Jura Impressa F90 coffee maker does not properly restrict access to privileged functions, which allows remote attackers to cause a denial of service (physical damage), modify coffee settings, and possibly execute code via a crafted request.  NOTE: this issue is being included in CVE because the denial of service may include financial loss or water damage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7174 
Multiple buffer overflows in the Jura Internet Connection Kit for the Jura Impressa F90 coffee maker allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors related to improper use of the gets and sprintf functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7175 
Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in NextGEN Gallery 0.96 and earlier plugin for Wordpress allows remote attackers to inject arbitrary web script or HTML via the picture description field in a page edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7176 
Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) change_lang parameter to index.php or (2) modload parameter to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7177 
Buffer overflow in the listing module in Netwide Assembler (NASM) before 2.03.01 has unknown impact and attack vectors, a different vulnerability than CVE-2008-2719.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7178 
Directory traversal vulnerability in Uploader module 1.1 for XOOPS allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter in a downloadfile action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7179 
OTManager CMS 2.4 allows remote attackers to bypass authentication and gain administrator privileges by setting the ADMIN_Hora, ADMIN_Logado, and ADMIN_Nome cookies to certain values, as reachable in Admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7180 
del_query1.php in Telephone Directory 2008 allows remote attackers to delete arbitrary contacts via a direct request with a modified id variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7181 
Butterfly Organizer 2.0.0 allows remote attackers to (1) delete arbitrary categories via a modified tablehere parameter to category-delete.php with the is_js_confirmed parameter set to 1, or (2) delete arbitrary accounts via the mytable parameter to delete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7182 
Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and possibly other versions before 3.9g2, allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long first argument to the APPEND command, a different vector than CVE-2008-1497 and CVE-2008-1498.  NOTE: due to lack of details, it is not certain whether this is the same issue as CVE-2008-2859.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T10:00:00.000Z
CVE-2008-7183 
PHP remote file inclusion vulnerability in eva/index.php in EVA CMS 2.3.1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the eva[caminho] parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T23:00:00.000Z
CVE-2008-7184 
Cross-site scripting (XSS) vulnerability in Diigo Toolbar and Diigolet allows remote attackers to inject arbitrary web script or HTML via a public comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T23:00:00.000Z
CVE-2008-7185 
GNOME Rhythmbox 0.11.5 allows remote attackers to cause a denial of service (segmentation fault and crash) via a playlist (.pls) file with a long Title field, possibly related to the g_hash_table_lookup function in b-playlist-manager.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T23:00:00.000Z
CVE-2008-7186 
Coppermine Photo Gallery (CPG) 1.4.14 does not restrict access to update.php, which allows remote attackers to obtain sensitive information such as the database table prefix via a direct request. NOTE: this might be leveraged for attacks against CVE-2008-0504.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T17:00:00.000Z
CVE-2008-7187 
Coppermine Photo Gallery (CPG) 1.4.14 allows remote attackers to obtain sensitive information via a direct request to include/slideshow.inc.php, which leaks the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T17:00:00.000Z
CVE-2008-7188 
ClipShare 2.6 does not properly restrict access to certain functionality, which allows remote attackers to change the profile of arbitrary users via a modified uid variable to siteadmin/useredit.php. NOTE: this can be used to recover the password of the user by using the modified e-mail address in the email parameter to recoverpass.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T17:00:00.000Z
CVE-2008-7189 
Multiple unspecified vulnerabilities in Local Media Browser before 0.1 have unknown impact and attack vectors related to "Security holes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T17:00:00.000Z
CVE-2008-7190 
Unspecified vulnerability in Adium before 1.2 has unknown impact and attack vectors related to javascript: URLs, possibly cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T17:00:00.000Z
CVE-2008-7191 
Unspecified vulnerability in Polipo before 1.0.4 allows remote attackers to cause a denial of service (crash) via a long request URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T17:00:00.000Z