rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-0410 
Unspecified vulnerability in the thread management in BEA WebLogic 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1, when T3 authentication is used, allows remote attackers to cause a denial of service (thread and system hang) via unspecified "sequences of events."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0411 
BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0412 
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP7, and 8.1 through 8.1 SP5 allows remote attackers to read arbitrary files inside the class-path property via .ear or exploded .ear files that use the manifest class-path property to point to utility jar files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0413 
BEA WebLogic Server 8.1 through 8.1 SP5 stores cleartext data in a backup of config.xml after offline editing, which allows local users to obtain sensitive information by reading this backup file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0414 
BEA WebLogic Server 6.1 through 6.1 SP7, 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, and 9.0 allows remote attackers to cause a denial of service (server hang) via certain requests that cause muxer threads to block when processing error pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0415 
BEA WebLogic Server 8.1 through 8.1 SP5 does not properly enforce access control after a dynamic update and dynamic redeployment of an application that is implemented through exploded jars, which allows attackers to bypass intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0416 
The WSEE runtime (WS-Security runtime) in BEA WebLogic Server 9.0 and 9.1 does not verify credentials when decrypting client messages, which allows remote attackers to bypass application security.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0417 
BEA WebLogic Server 7.0 through 7.0 SP7, 8.1 through 8.1 SP5, 9.0, and 9.1, when using the WebLogic Server 6.1 compatibility realm, allows attackers to execute certain EJB container persistence operations with an administrative identity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0418 
BEA WebLogic Server 7.0 through 7.0 SP6, 8.1 through 8.1 SP5, 9.0, and 9.1 does not enforce a security policy that declares permissions for EJB methods that have array parameters, which allows remote attackers to obtain unauthorized access to these methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0419 
The BEA WebLogic Server proxy plug-in before June 2006 for the Apache HTTP Server does not properly handle protocol errors, which allows remote attackers to cause a denial of service (server outage).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0420 
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold allows remote attackers to obtain sensitive information via malformed HTTP requests, which reveal data from previous requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0421 
BEA WebLogic Server 6.1 through 6.1 SP7, and 7.0 through 7.0 SP7 allows remote attackers to cause a denial of service (disk consumption) via requests containing malformed headers, which cause a large amount of data to be written to the server log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0422 
BEA WebLogic Server 9.0, 9.1, and 9.2 Gold, when running on Solaris 9, allows remote attackers to cause a denial of service (server inaccessibility) via manipulated socket connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0423 
BEA WebLogic Portal 9.2 does not properly handle when an administrator deletes entitlements for a role, which causes other role entitlements to be "inadvertently affected," which has an unknown impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0424 
Unspecified vulnerability in the BEA WebLogic Server proxy plug-in for Netscape Enterprise Server before September 2006 for Netscape Enterprise Server allow remote attackers to cause a denial of service via certain requests that trigger errors that lead to a server being marked as unavailable, hosting web server failure, or CPU consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0425 
Unspecified vulnerability in BEA WebLogic Platform and Server 8.1 through 8.1 SP5, and JRockit 1.4.2 R4.5 and earlier, allows attackers to gain privileges via unspecified vectors, related to an "overflow condition," probably a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0426 
BEA WebLogic Portal 9.2, when running in a WebLogic Server clustered environment using WebLogic Portal entitlements, does not properly propagate entitlement policy changes if the changes are made on a managed server while the Administrative Server is unavailable, which might allow attackers to bypass intended restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0427 
Stack-based buffer overflow in Microsoft Help Workshop 4.03.0002 allows user-assisted remote attackers to execute arbitrary code via a help project (.HPJ) file with a long HLP field in the OPTIONS section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T00:00:00.000Z
CVE-2007-0428 
Unspecified vulnerability in the chtbl_lookup function in hash.c for WzdFTPD 8.0 and earlier allows remote attackers to cause a denial of service via a crafted FTP command, probably due to a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0429 
DivXBrowserPlugin (aka DivX Web Player) npdivx32.dll, as distributed with DivX Player 6.4.1, allows remote attackers to cause a denial of service (Internet Explorer 7 crash) by invoking the GoWindowed method for a certain instance of the ActiveX object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0430 
The shared_region_map_file_np function in Apple Mac OS X 10.4.8 and earlier kernel allows local users to cause a denial of service (memory corruption) via a large mappingCount value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0431 
AVM Fritz!Box 7050, and possibly other product models, allows remote attackers to cause a denial of service (VoIP application crash) via a zero-length UDP packet to the SIP port (port 5060).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0432 
BEA AquaLogic Service Bus 2.0, 2.1, and 2.5 does not properly reject malformed request messages to a proxy service, which might allow remote attackers to bypass authorization policies and route requests to back-end services or conduct other unauthorized activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0433 
Unspecified vulnerability in BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2, when using Active Directory LDAP for authentication, allows remote authenticated users to access the server even after the account has been disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0434 
BEA AquaLogic Enterprise Security 2.0 through 2.0 SP2, 2.1 through 2.1 SP1, and 2.2 does not properly set the severity level of audit events when the system load is high, which might make it easier for attackers to avoid detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0435 
T-Com Speedport 500V routers with firmware 1.31 allow remote attackers to bypass authentication and reconfigure the device via a LOGINKEY=TECOM cookie value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T02:00:00.000Z
CVE-2007-0436 
Barron McCann X-Kryptor Driver BMS1446HRR (Xgntr BMS1351 Install BMS1472) in X-Kryptor Secure Client does not drop privileges when launching an Explorer window in response to a help command, which allows local users to gain LocalSystem privileges via interactive use of Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-04T00:00:00.000Z
CVE-2007-0437 
Multiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via (1) the TO parameter to loop.csp, (2) the VALUE parameter to cookie.csp, and (3) the PAGE parameter to showsource.csp in csp/samples/; and allow remote authenticated users to inject arbitrary web script or HTML via (4) the ERROR parameter to csp/samples/xmlclasseserror.csp, and unspecified vectors in (5) object.csp and (6) lotteryhistory.csp in csp/samples/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-08-20T18:00:00.000Z
CVE-2007-0441 
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 6.20, 6.4x, 7.01, and 7.50 allows remote attackers to execute arbitrary commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T16:00:00.000Z
CVE-2007-0442 
Unspecified vulnerability in IBM OS/400 R530 and R535 has unknown impact and remote attack vectors, related to an "Integrity Problem" involving LIC-TCPIP and TCP reset.  NOTE: it is possible that this issue is related to CVE-2004-0230, but this is not certain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T16:00:00.000Z
CVE-2007-0443 
Multiple buffer overflows in the CDDBControl ActiveX control in Gracenote CDDB before 20070418 allow remote attackers to execute arbitrary code via long values for certain Proxy configuration parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-24T16:00:00.000Z
CVE-2007-0444 
Stack-based buffer overflow in the print provider library (cpprov.dll) in Citrix Presentation Server 4.0, MetaFrame Presentation Server 3.0, and MetaFrame XP 1.0 allows local users and remote attackers to execute arbitrary code via long arguments to the (1) EnumPrintersW and (2) OpenPrinter functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T22:00:00.000Z
CVE-2007-0445 
Heap-based buffer overflow in the arj.ppl module in the OnDemand Scanner in Kaspersky Anti-Virus, Anti-Virus for Workstations, and Anti-Virus for File Servers 6.0, and Internet Security 6.0 before Maintenance Pack 2 build 6.0.2.614 allows remote attackers to execute arbitrary code via crafted ARJ archives.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-06T00:00:00.000Z
CVE-2007-0446 
Stack-based buffer overflow in magentproc.exe for Hewlett-Packard Mercury LoadRunner Agent 8.0 and 8.1, Performance Center Agent 8.0 and 8.1, and Monitor over Firewall 8.1 allows remote attackers to execute arbitrary code via a packet with a long server_ip_name field to TCP port 54345, which triggers the overflow in mchan.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T23:00:00.000Z
CVE-2007-0447 
Heap-based buffer overflow in the Decomposer component in multiple Symantec products allows remote attackers to execute arbitrary code via multiple crafted CAB archives.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-05T21:00:00.000Z
CVE-2007-0448 
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-24T18:00:00.000Z
CVE-2007-0449 
Multiple buffer overflows in LGSERVER.EXE in CA BrightStor ARCserve Backup for Laptops and Desktops r11.0 through r11.1 SP1, Mobile Backup r4.0, Desktop and Business Protection Suite r2, and Desktop Management Suite (DMS) r11.0 and r11.1 allow remote attackers to execute arbitrary code via crafted packets to TCP port (1) 1900 or (2) 2200.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-23T21:00:00.000Z
CVE-2007-0450 
Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-16T22:00:00.000Z
CVE-2007-0451 
Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-16T19:00:00.000Z
CVE-2007-0452 
smbd in Samba 3.0.6 through 3.0.23d allows remote authenticated users to cause a denial of service (memory and CPU exhaustion) by renaming a file in a way that prevents a request from being removed from the deferred open queue, which triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-06T02:00:00.000Z
CVE-2007-0453 
Buffer overflow in the nss_winbind.so.1 library in Samba 3.0.21 through 3.0.23d, as used in the winbindd daemon on Solaris, allows attackers to execute arbitrary code via the (1) gethostbyname and (2) getipnodebyname functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-06T02:00:00.000Z
CVE-2007-0454 
Format string vulnerability in the afsacl.so VFS module in Samba 3.0.6 through 3.0.23d allows context-dependent attackers to execute arbitrary code via format string specifiers in a filename on an AFS file system, which is not properly handled during Windows ACL mapping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-06T02:00:00.000Z
CVE-2007-0455 
Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0456 
Unspecified vulnerability in the LLT dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-02T20:00:00.000Z
CVE-2007-0457 
Unspecified vulnerability in the IEEE 802.11 dissector in Wireshark (formerly Ethereal) 0.10.14 through 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-02T20:00:00.000Z
CVE-2007-0458 
Unspecified vulnerability in the HTTP dissector in Wireshark (formerly Ethereal) 0.99.3 and 0.99.4 allows remote attackers to cause a denial of service (application crash) via unspecified vectors, a different issue than CVE-2006-5468.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-02T20:00:00.000Z
CVE-2007-0459 
packet-tcp.c in the TCP dissector in Wireshark (formerly Ethereal) 0.99.2 through 0.99.4 allows remote attackers to cause a denial of service (application crash or hang) via fragmented HTTP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-02T20:00:00.000Z
CVE-2007-0460 
Multiple buffer overflows in ulogd for SUSE Linux 9.3 up to 10.1, and possibly other distributions, have unknown impact and attack vectors related to "improper string length calculations."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T01:00:00.000Z
CVE-2007-0461 
Multiple memory leaks in the Dazuko anti-virus helper module before 2.3.2 allow attackers to cause a denial of service (memory consumption) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T01:00:00.000Z
CVE-2007-0462 
The _GetSrcBits32ARGB function in Apple QuickDraw, as used by Quicktime 7.1.3 and other applications on Mac OS X 10.4.8 and earlier, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PICT image with a malformed Alpha RGB (ARGB) record, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-26T01:00:00.000Z
CVE-2007-0463 
Format string vulnerability in Apple Software Update 2.0.5 on Mac OS X 10.4.8 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via format string specifiers in (1) SWUTMP or (2) SUCATALOG filenames, or using the (3) application/x-apple.sucatalog+xml MIME type.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-29T16:00:00.000Z
CVE-2007-0464 
The _CFNetConnectionWillEnqueueRequests function in CFNetwork 129.19 on Apple Mac OS X 10.4 through 10.4.10 allows remote attackers to cause a denial of service (application crash) via a crafted HTTP 301 response, which results in a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-30T17:00:00.000Z
CVE-2007-0465 
Format string vulnerability in Apple Installer 2.1.5 on Mac OS X 10.4.8 allows user-assisted remote attackers to execute arbitrary code via format string specifiers in a (1) PKG, (2) DISTZ, or (3) MPKG package filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-31T01:00:00.000Z
CVE-2007-0466 
Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 allows remote attackers to execute arbitrary code via a crafted ASF_File_Properties_Object size field in a WMV file, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-31T01:00:00.000Z
CVE-2007-0467 
crashdump in Apple Mac OS X 10.4.8 allows local users in the admin group to modify arbitrary files or gain privileges via a symlink attack on application logs in /Library/Logs/CrashReporter/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-31T02:00:00.000Z
CVE-2007-0468 
Stack-based buffer overflow in rcdll.dll in msdev.exe in Visual C++ (MSVC) in Microsoft Visual Studio 6.0 SP6 allows user-assisted remote attackers to execute arbitrary code via a long file path in the "1 TYPELIB MOVEABLE PURE" option in an RC file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T01:00:00.000Z
CVE-2007-0469 
The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T01:00:00.000Z
CVE-2007-0470 
Multiple unspecified vulnerabilities in tip in Sun Solaris 8, 9, and 10 allow local users to gain uucp account privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T01:00:00.000Z
CVE-2007-0471 
sre/params.php in the Integrity Clientless Security (ICS) component in Check Point Connectra NGX R62 3.x and earlier before Security Hotfix 5, and possibly VPN-1 NGX R62, allows remote attackers to bypass security requirements via a crafted Report parameter, which returns a valid ICSCookie authentication token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-24T01:00:00.000Z
CVE-2007-0472 
Multiple race conditions in Smb4K before 0.8.0 allow local users to (1) modify arbitrary files via unspecified manipulations of Smb4K's lock file, which is not properly handled by the remove_lock_file function in core/smb4kfileio.cpp, and (2) add lines to the sudoers file via a symlink attack on temporary files, which isn't properly handled by the writeFile function in core/smb4kfileio.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-03T23:00:00.000Z
CVE-2007-0473 
The writeFile function in core/smb4kfileio.cpp in Smb4K before 0.8.0 does not preserve /etc/sudoers permissions across modifications, which allows local users to obtain sensitive information (/etc/sudoers contents) by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-03T23:00:00.000Z
CVE-2007-0474 
Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to kill arbitrary processes, related to a "design issue with smb4k_kill."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-03T23:00:00.000Z
CVE-2007-0475 
Multiple stack-based buffer overflows in utilities/smb4k_*.cpp in Smb4K before 0.8.0 allow local users, when present on the Smb4K sudoers list, to gain privileges via unspecified vectors related to the args variable and unspecified other variables, in conjunction with the sudo configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-03T23:00:00.000Z
CVE-2007-0476 
The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-25T00:00:00.000Z