rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-0875 
SQL injection vulnerability in install.php in mcRefer allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this issue has been disputed by a third party, stating that the file does not use a SQL database
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T19:00:00.000Z
CVE-2007-0876 
Cross-site scripting (XSS) vulnerability in Quick Digital Image Gallery (Qdig) 1.2.9.3 and devel-20060624 allows remote attackers to inject arbitrary web script or HTML via the Qwd parameter to the top-level URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T19:00:00.000Z
CVE-2007-0877 
Unspecified vulnerability in March Networks DVR 3000 and 4000 Digital Video Recorders allows attackers to cause an unspecified denial of service.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T19:00:00.000Z
CVE-2007-0878 
Unspecified vulnerability in Microsoft Internet Explorer on Windows Mobile 5.0 allows remote attackers to cause a denial of service (loss of browser and other device functionality) via a malformed WML page, related to an "overflow state." NOTE: it is possible that this issue is related to CVE-2007-0685.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0879 
Buffer overflow in SmidgeonSoft PEBrowse Professional 8.2.1.0 allows user-assisted remote attackers to execute arbitrary code via certain executable files in PE format.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0880 
Capital Request Forms stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain database credentials via a direct request for inc/common_db.inc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0881 
PHP remote file inclusion vulnerability in the Seitenschutz plugin for OPENi-CMS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the (1) config[oi_dir] and possibly (2) config[openi_dir] parameters to open-admin/plugins/site_protection/index.php.  NOTE: vector 2 might be the same as CVE-2006-4750.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0882 
Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11) misinterprets certain client "-f" sequences as valid requests for the login program to skip authentication, which allows remote attackers to log into certain accounts, as demonstrated by the bin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0883 
Directory traversal vulnerability in portalgroups/portalgroups/getfile.cgi in IP3 NetAccess before firmware 4.1.9.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0884 
Buffer overflow in Roaring Penguin MIMEDefang 2.59 and 2.60 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0885 
Cross-site scripting (XSS) vulnerability in jira/secure/BrowseProject.jspa in Rainbow with the Zen (Rainbow.Zen) extension allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T20:00:00.000Z
CVE-2007-0886 
Heap-based buffer underflow in axigen 1.2.6 through 2.0.0b1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via certain base64-encoded data on the pop3 port (110/tcp), which triggers an integer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0887 
axigen 1.2.6 through 2.0.0b1 does not properly parse login credentials, which allows remote attackers to cause a denial of service (NULL dereference and application crash) via a base64-encoded "*\x00" sequence on the imap port (143/tcp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0888 
Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0889 
Kiwi CatTools before 3.2.0 beta uses weak encryption ("reversible encoding") for passwords, account names, and IP addresses in kiwidb-cattools.kdb, which might allow local users to gain sensitive information by decrypting the file.  NOTE: this issue could be leveraged with a directory traversal vulnerability for a remote attack vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0890 
Cross-site scripting (XSS) vulnerability in scripts/passwdmysql in cPanel WebHost Manager (WHM) 11.0.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0891 
Cross-site scripting (XSS) vulnerability in the GetCurrentCompletePath function in phpmyvisites.php in phpMyVisites before 2.2 allows remote attackers to inject arbitrary web script or HTML via the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0892 
CRLF injection vulnerability in phpMyVisites before 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the url parameter, when the pagename parameter begins with "FILE:".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0893 
Directory traversal vulnerability in phpMyVisites before 2.2 allows remote attackers to include arbitrary files via leading ".." sequences on the pmv_ck_view COOKIE parameter, which bypasses the protection scheme.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0894 
MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to (1) Simple.deps.php, (2) MonoBook.deps.php, (3) MySkin.deps.php, or (4) Chick.deps.php in wiki/skins, which shows the installation path in the resulting error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2007-0895 
Race condition in recursive directory deletion with the (1) -r or (2) -R option in rm in Solaris 8 through 10 before 20070208 allows local users to delete files and directories as the user running rm by moving a low-level directory to a higher level as it is being deleted, which causes rm to chdir to a ".." directory that is higher than expected, possibly up to the root file system, a related issue to CVE-2002-0435.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T01:00:00.000Z
CVE-2007-0896 
Cross-site scripting (XSS) vulnerability in the (1) Sage before 1.3.10, and (2) Sage++ extensions for Firefox, allows remote attackers to inject arbitrary web script or HTML via a "<SCRIPT/=''SRC='" sequence in an RSS feed, a different vulnerability than CVE-2006-4712.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T11:00:00.000Z
CVE-2007-0897 
Clam AntiVirus ClamAV before 0.90 does not close open file descriptors under certain conditions, which allows remote attackers to cause a denial of service (file descriptor consumption and failed scans) via CAB archives with a cabinet header record length of zero, which causes a function to return without closing a file descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-16T19:00:00.000Z
CVE-2007-0898 
Directory traversal vulnerability in clamd in Clam AntiVirus ClamAV before 0.90 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the id MIME header parameter in a multi-part message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-16T19:00:00.000Z
CVE-2007-0899 
There is a possible heap overflow in libclamav/fsg.c before 0.100.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T03:10:38.000Z
CVE-2007-0900 
Multiple PHP remote file inclusion vulnerabilities in TagIt! Tagboard 2.1.B Build 2 and earlier, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the (1) configpath parameter to (a) tagviewer.php, (b) tag_process.php, and (c) CONFIG/errmsg.inc.php; and (d) addTagmin.php, (e) ban_watch.php, (f) delTagmin.php, (g) delTag.php, (h) editTagmin.php, (i) editTag.php, (j) manageTagmins.php, and (k) verify.php in tagmin/; the (2) adminpath parameter to (l) tagviewer.php, (m) tag_process.php, and (n) tagmin/index.php; and the (3) admin parameter to (o) readconf.php, (p) updateconf.php, (q) updatefilter.php, and (r) wordfilter.php in tagmin/; different vectors than CVE-2006-5249.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T20:00:00.000Z
CVE-2007-0901 
Multiple cross-site scripting (XSS) vulnerabilities in Info pages in MoinMoin 1.5.7 allow remote attackers to inject arbitrary web script or HTML via the (1) hitcounts and (2) general parameters, different vectors than CVE-2007-0857.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T20:00:00.000Z
CVE-2007-0902 
Unspecified vulnerability in the "Show debugging information" feature in MoinMoin 1.5.7 allows remote attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T20:00:00.000Z
CVE-2007-0903 
Unspecified vulnerability in the mod_roster_odbc module in ejabberd before 1.1.3 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T20:00:00.000Z
CVE-2007-0904 
SQL injection vulnerability in projects.php in LightRO CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T20:00:00.000Z
CVE-2007-0905 
PHP before 5.2.1 allows attackers to bypass safe_mode and open_basedir restrictions via unspecified vectors in the session extension.  NOTE: it is possible that this issue is a duplicate of CVE-2006-6383.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0906 
Multiple buffer overflows in PHP before 5.2.1 allow attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors in the (1) session, (2) zip, (3) imap, and (4) sqlite extensions; (5) stream filters; and the (6) str_replace, (7) mail, (8) ibase_delete_user, (9) ibase_add_user, and (10) ibase_modify_user functions.  NOTE: vector 6 might actually be an integer overflow (CVE-2007-1885).  NOTE: as of 20070411, vector (3) might involve the imap_mail_compose function (CVE-2007-1825).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0907 
Buffer underflow in PHP before 5.2.1 allows attackers to cause a denial of service via unspecified vectors involving the sapi_header_op function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0908 
The WDDX deserializer in the wddx extension in PHP 5 before 5.2.1 and PHP 4 before 4.4.5 does not properly initialize the key_length variable for a numerical key, which allows context-dependent attackers to read stack memory via a wddxPacket element that contains a variable with a string name before a numerical variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0909 
Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems, and (2) the odbc_result_all function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0910 
Unspecified vulnerability in PHP before 5.2.1 allows attackers to "clobber" certain super-global variables via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0911 
Off-by-one error in the str_ireplace function in PHP 5.2.1 might allow context-dependent attackers to cause a denial of service (crash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0912 
Cross-Site Request Forgery (CSRF) vulnerability in admin/admin.adm.php in Jportal 2.3.1, and possibly earlier, allows remote attackers to perform privileged actions as administrators by tricking the admin into accessing a URL with modified arguments to admin/admin.adm.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-13T23:00:00.000Z
CVE-2007-0913 
Unspecified vulnerability in Microsoft Powerpoint allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as exploited by Trojan.PPDropper.G.  NOTE: as of 20070213, it is not clear whether this is the same issue as CVE-2006-5296, CVE-2006-4694, CVE-2006-3876, CVE-2006-3877, or older issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T01:00:00.000Z
CVE-2007-0914 
Race condition in the TCP subsystem for Solaris 10 allows remote attackers to cause a denial of service (system panic) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T02:00:00.000Z
CVE-2007-0915 
Distributed SLS daemon (SLSd) on HP-UX B.11.11 allows remote attackers to overwrite arbitrary files and gain privileges via a crafted RPC request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T02:00:00.000Z
CVE-2007-0916 
Unspecified vulnerability in the Address and Routing Parameter Area (ARPA) transport functionality in HP-UX B.11.11 and B.11.23 allows local users to cause an unspecified denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T02:00:00.000Z
CVE-2007-0917 
The Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XE to 12.3T allows remote attackers to bypass IPS signatures that use regular expressions via fragmented packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T02:00:00.000Z
CVE-2007-0918 
The ATOMIC.TCP signature engine in the Intrusion Prevention System (IPS) feature for Cisco IOS 12.4XA, 12.3YA, 12.3T, and other trains allows remote attackers to cause a denial of service (IPS crash and traffic loss) via unspecified manipulations that are not properly handled by the regular expression feature, as demonstrated using the 3123.0 (Netbus Pro Traffic) signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T02:00:00.000Z
CVE-2007-0919 
Directory traversal vulnerability in Nickolas Grigoriadis Mini Web server (MiniWebsvr) 0.0.6 allows remote attackers to list the directory immediately above the web root via a ..%00 sequence in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0920 
SQL injection vulnerability in philboard_forum.asp in Philboard 1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0921 
Portal Search allows remote attackers to redirect a URL to an arbitrary web site by placing the URL in the query string to the top-level URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0922 
Cross-site scripting (XSS) vulnerability in buscador/buscador.htm in Portal Search allows remote attackers to inject arbitrary web script or HTML via the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0923 
buscador/buscador.htm in Portal Search allows remote attackers to obtain sensitive information (business logic) via a query string composed of a search for certain characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0924 
Till Gerken phpPolls 1.0.3 allows remote attackers to bypass authentication and perform certain administrative actions via a direct request to phpPollAdmin.php3.  NOTE: this issue might subsume CVE-2006-3764.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0925 
Cross-site scripting (XSS) vulnerability in search/SearchResults.aspx in Community Server allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0926 
The dologin function in guestbook.php in KvGuestbook 1.0 Beta allows remote attackers to gain administrative privileges, probably via modified $mysql['pass'] and $gbpass variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0927 
Heap-based buffer overflow in uTorrent 1.6 allows remote attackers to execute arbitrary code via a torrent file with a crafted announce header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0928 
Virtual Calendar stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an encoded password via a direct request for pwd.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0929 
Directory traversal vulnerability in php rrd browser before 0.2.1 allows remote attackers to read arbitrary files via ".." sequences in the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0930 
Variable extract vulnerability in Apache Stats before 0.0.3beta allows attackers to modify arbitrary variables and conduct attacks via unknown vectors involving the use of PHP's extract function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0931 
Heap-based buffer overflow in the management interfaces in (1) Aruba Mobility Controllers 200, 800, 2400, and 6000 and (2) Alcatel-Lucent OmniAccess Wireless 43xx and 6000 allows remote attackers to cause a denial of service (process crash) and possibly execute arbitrary code via long credential strings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0932 
The (1) Aruba Mobility Controllers 200, 600, 2400, and 6000 and (2) Alcatel-Lucent OmniAccess Wireless 43xx and 6000 do not properly implement authentication and privilege assignment for the guest account, which allows remote attackers to access administrative interfaces or the WLAN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-14T11:00:00.000Z
CVE-2007-0933 
Buffer overflow in the wireless driver 6.0.0.18 for D-Link DWL-G650+ (Rev. A1) on Windows XP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a beacon frame with a long TIM Information Element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-05T21:00:00.000Z
CVE-2007-0934 
Unspecified vulnerability in Microsoft Visio 2002 allows remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted version number that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-0936 
Multiple unspecified vulnerabilities in Microsoft Visio 2002 allow remote user-assisted attackers to execute arbitrary code via a Visio (.VSD, VSS, .VST) file with a crafted packed object that triggers memory corruption, aka "Visio Document Packaging Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-12T19:00:00.000Z
CVE-2007-0938 
Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 does not properly handle certain characters in a crafted HTTP GET request, which allows remote attackers to execute arbitrary code, aka the "CMS Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T21:00:00.000Z
CVE-2007-0939 
Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka "Cross-site Scripting and Spoofing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T21:00:00.000Z
CVE-2007-0940 
Unspecified vulnerability in the Cryptographic API Component Object Model Certificates ActiveX control (CAPICOM.dll) in Microsoft CAPICOM and BizTalk Server 2004 SP1 and SP2 allows remote attackers to execute arbitrary code via unspecified vectors, aka the "CAPICOM.Certificates Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z
CVE-2007-0942 
Microsoft Internet Explorer 5.01 SP4 on Windows 2000 SP4; 6 SP1 on Windows 2000 SP4; 6 and 7 on Windows XP SP2, or Windows Server 2003 SP1 or SP2; and possibly 7 on Windows Vista does not properly "instantiate certain COM objects as ActiveX controls," which allows remote attackers to execute arbitrary code via a crafted COM object from chtskdic.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-08T23:00:00.000Z