rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-3466 
Microsoft Host Integration Server (HIS) 2000, 2004, and 2006 does not limit RPC access to administrative functions, which allows remote attackers to bypass authentication and execute arbitrary programs via a crafted SNA RPC message using opcode 1 or 6 to call the CreateProcess function, aka "HIS Command Execution Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3471 
Stack-based buffer overflow in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via a BIFF file with a malformed record that triggers a user-influenced size calculation, aka "File Format Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3472 
Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, via a crafted HTML document, aka "HTML Element Cross-Domain Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3473 
Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, via a crafted HTML document, aka "Event Handling Cross-Domain Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3474 
Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy and obtain sensitive information via a crafted HTML document, aka "Cross-Domain Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3475 
Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3476 
Microsoft Internet Explorer 5.01 SP4 and 6 does not properly handle errors associated with access to uninitialized memory, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "HTML Objects Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3477 
Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office document with an embedded object, which allows remote attackers to execute arbitrary code via an Excel file containing a crafted value, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption, aka "Calendar Object Validation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3479 
Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers to read memory contents and execute arbitrary code via a crafted RPC call, related to improper processing of parameters to string APIs, aka "Message Queuing Service Remote Code Execution Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-15T00:00:00.000Z
CVE-2008-3480 
Stack-based buffer overflow in the Anzio Web Print Object (WePO) ActiveX control 3.2.19 and 3.2.24, as used in Anzio Print Wizard, allows remote attackers to execute arbitrary code via a long mainurl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-29T17:00:00.000Z
CVE-2008-3481 
themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-05T19:20:00.000Z
CVE-2008-3482 
Cross-site scripting (XSS) vulnerability in the error page feature in Panasonic Network Camera BL-C111, BL-C131, BB-HCM511, BB-HCM531, BB-HCM580, BB-HCM581, BB-HCM527, and BB-HCM515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-05T20:00:00.000Z
CVE-2008-3483 
Cross-site scripting (XSS) vulnerability in ScrewTurn Wiki 2.0.29 and 2.0.30 allows remote attackers to inject arbitrary web script or HTML via error messages in the "/admin.aspx - System Log" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-05T20:00:00.000Z
CVE-2008-3484 
SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a showcat action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-05T21:00:00.000Z
CVE-2008-3485 
Untrusted search path vulnerability in Citrix MetaFrame Presentation Server allows local users to gain privileges via a malicious icabar.exe placed in the search path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T17:05:00.000Z
CVE-2008-3486 
Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang part of serialized data in an _data cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T17:05:00.000Z
CVE-2008-3487 
SQL injection vulnerability in profile.php in PHPAuction GPL Enhanced 2.51 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T17:05:00.000Z
CVE-2008-3488 
Unspecified vulnerability in Novell iManager before 2.7 SP1 (2.7.1) allows remote attackers to delete Plug-in Studio created Property Book Pages via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T17:05:00.000Z
CVE-2008-3489 
SQL injection vulnerability in checkCookie function in includes/functions.inc.php in PHPX 3.5.16 allows remote attackers to execute arbitrary SQL commands via a PXL cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T17:05:00.000Z
CVE-2008-3490 
SQL injection vulnerability in members/mail.php in E-topbiz Online Dating 3 1.0 allows remote authenticated users to execute arbitrary SQL commands via the mail_id parameter in a veiw action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T17:05:00.000Z
CVE-2008-3491 
SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a report action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T17:05:00.000Z
CVE-2008-3492 
America's Army (aka AA or Army Game Project) 2.8.3.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted UDP packet, probably involving a VoiceIndex value that is outside of the range specified by VOICE_MAX_CHATTERS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3493 
vncviewer.exe in RealVNC Windows Client 4.1.2.0 allows remote VNC servers to cause a denial of service (application crash) via a crafted frame buffer update packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3494 
8e6 R3000 Internet Filter 2.0.12.10 allows remote attackers to bypass intended restrictions via an extra HTTP Host header with additional leading text placed before the real Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3495 
SQL injection vulnerability in kategori.asp in Pcshey Portal allows remote attackers to execute arbitrary SQL commands via the kid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3496 
Buffer overflow in format descriptor parsing in the uvc_parse_format function in drivers/media/video/uvc/uvc_driver.c in uvcvideo in the video4linux (V4L) implementation in the Linux kernel before 2.6.26.1 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3497 
SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3498 
SQL injection vulnerability in the nBill (com_netinvoice) component 1.2.0 SP1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in an orders action to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3499 
Unspecified vulnerability in "a page in the workarea folder" in Ektron CMS400.NET 7.00 through 7.04 and 7.50 through 7.52 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3500 
Cross-site scripting (XSS) vulnerability in the Suggested Terms module 5.x before 5.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via crafted Taxonomy terms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3501 
Cross-site scripting (XSS) vulnerability in the WebAccess simple interface in Novell Groupwise 7.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3502 
Unspecified vulnerability in Best Practical Solutions RT 3.0.0 through 3.6.6 allows remote authenticated users to cause a denial of service (CPU or memory consumption) via unspecified vectors related to the Devel::StackTrace module for Perl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3503 
RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System (CS) RSS feeds, which allows remote attackers to obtain sensitive information (CS data).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3504 
Unspecified vulnerability in mask PHP File Manager (mPFM) before 2.3 has unknown impact and remote attack vectors related to "manipulation of cookies."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3505 
Cross-site scripting (XSS) vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via the nr parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3506 
SQL injection vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to execute arbitrary SQL commands via the nr parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-06T18:00:00.000Z
CVE-2008-3507 
SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-07T20:00:00.000Z
CVE-2008-3508 
LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-07T20:00:00.000Z
CVE-2008-3509 
LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in system/admin/, which allows remote attackers to change the configuration or execute arbitrary PHP code via addition of blocks, and other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-07T20:00:00.000Z
CVE-2008-3510 
Cross-site scripting (XSS) vulnerability in livehelp_js.php in Crafty Syntax Live Help (CSLH) 2.14.6 allows remote attackers to inject arbitrary web script or HTML via the department parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-07T20:00:00.000Z
CVE-2008-3511 
Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Image Gallery (Photo Gallery) allow remote attackers to inject arbitrary web script or HTML via the (1) latest parameter to (a) index.php, (b) images.php, (c) suggest_image.php, and (d) image_desc.php; and the (2) msg parameter to index.php, images.php, and suggest_image.php, and (e) index.php, (f) adminhome.php, (g) config.php, (h) changepassword.php, (i) cleanup.php, (j) browsecats.php, and (k) images.php in admin/. NOTE: the image_desc.php/msg vector is covered by CVE-2006-1660.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-07T20:00:00.000Z
CVE-2008-3512 
SQL injection vulnerability in the Kleinanzeigen module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a visit action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-07T20:00:00.000Z
CVE-2008-3513 
SQL injection vulnerability in the Book Catalog module 1.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-07T20:00:00.000Z
CVE-2008-3514 
VMware VirtualCenter 2.5 before Update 2 and 2.0.2 before Update 5 relies on client-side "enabled/disabled functionality" for access control, which allows remote attackers to determine valid user names by enabling functionality in the GUI and then making an "attempt to assign permissions to other system users."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T10:00:00.000Z
CVE-2008-3515 
Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js, a different vulnerability than CVE-2008-3516.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T00:00:00.000Z
CVE-2008-3516 
Multiple cross-site scripting (XSS) vulnerabilities in files generated by Adobe Presenter 6 and 7 before 7.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) viewer.swf and (2) loadflash.js, a different vulnerability than CVE-2008-3515.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T00:00:00.000Z
CVE-2008-3519 
The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote attackers to obtain sensitive information (non-EJB classes) via a download request, a different vulnerability than CVE-2008-3273.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T14:00:00.000Z
CVE-2008-3520 
Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-02T18:00:00.000Z
CVE-2008-3521 
Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit.  NOTE: this was originally reported as a symlink issue, but this was incorrect.  NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-02T18:00:00.000Z
CVE-2008-3522 
Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-02T18:00:00.000Z
CVE-2008-3524 
rc.sysinit in initscripts before 8.76.3-1 on Fedora 9 and other Linux platforms allows local users to delete arbitrary files via a symlink attack on a file or directory under (1) /var/lock or (2) /var/run.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-29T17:00:00.000Z
CVE-2008-3525 
The sbni_ioctl function in drivers/net/wan/sbni.c in the wan subsystem in the Linux kernel 2.6.26.3 does not check for the CAP_NET_ADMIN capability before processing a (1) SIOCDEVRESINSTATS, (2) SIOCDEVSHWSTATE, (3) SIOCDEVENSLAVE, or (4) SIOCDEVEMANSIPATE ioctl request, which allows local users to bypass intended capability restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-03T14:00:00.000Z
CVE-2008-3526 
Integer overflow in the sctp_setsockopt_auth_key function in net/sctp/socket.c in the Stream Control Transmission Protocol (sctp) implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows remote attackers to cause a denial of service (panic) or possibly have unspecified other impact via a crafted sca_keylength field associated with the SCTP_AUTH_KEY option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-27T20:00:00.000Z
CVE-2008-3527 
arch/i386/kernel/sysenter.c in the Virtual Dynamic Shared Objects (vDSO) implementation in the Linux kernel before 2.6.21 does not properly check boundaries, which allows local users to gain privileges or cause a denial of service via unspecified vectors, related to the install_special_mapping, syscall, and syscall32_nopage functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-05T14:51:00.000Z
CVE-2008-3528 
The error-reporting functionality in (1) fs/ext2/dir.c, (2) fs/ext3/dir.c, and possibly (3) fs/ext4/dir.c in the Linux kernel 2.6.26.5 does not limit the number of printk console messages that report directory corruption, which allows physically proximate attackers to cause a denial of service (temporary system hang) by mounting a filesystem that has corrupted dir->i_size and dir->i_blocks values and performing (a) read or (b) write operations.  NOTE: there are limited scenarios in which this crosses privilege boundaries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-27T00:00:00.000Z
CVE-2008-3529 
Heap-based buffer overflow in the xmlParseAttValueComplex function in parser.c in libxml2 before 2.7.0 allows context-dependent attackers to cause a denial of service (crash) or execute arbitrary code via a long XML entity name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-12T16:00:00.000Z
CVE-2008-3530 
sys/netinet6/icmp6.c in the kernel in FreeBSD 6.3 through 7.1, NetBSD 3.0 through 4.0, and possibly other operating systems does not properly check the proposed new MTU in an ICMPv6 Packet Too Big Message, which allows remote attackers to cause a denial of service (panic) via a crafted Packet Too Big Message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-05T16:00:00.000Z
CVE-2008-3531 
Stack-based buffer overflow in sys/kern/vfs_mount.c in the kernel in FreeBSD 7.0 and 7.1, when vfs.usermount is enabled, allows local users to gain privileges via a crafted (1) mount or (2) nmount system call, related to copying of "user defined data" in "certain error conditions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-05T16:00:00.000Z
CVE-2008-3532 
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-08T19:00:00.000Z
CVE-2008-3533 
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-18T17:15:00.000Z
CVE-2008-3534 
The shmem_delete_inode function in mm/shmem.c in the tmpfs implementation in the Linux kernel before 2.6.26.1 allows local users to cause a denial of service (system crash) via a certain sequence of file create, remove, and overwrite operations, as demonstrated by the insserv program, related to allocation of "useless pages" and improper maintenance of the i_blocks count.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-08T19:00:00.000Z
CVE-2008-3535 
Off-by-one error in the iov_iter_advance function in mm/filemap.c in the Linux kernel before 2.6.27-rc2 allows local users to cause a denial of service (system crash) via a certain sequence of file I/O operations with readv and writev, as demonstrated by testcases/kernel/fs/ftest/ftest03 from the Linux Test Project.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-08T19:00:00.000Z