rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-3280 
The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-19T21:00:00.000Z
CVE-2007-3281 
Cross-site scripting (XSS) vulnerability in index.php in Php Hosting Biller 1.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-19T21:00:00.000Z
CVE-2007-3282 
Buffer overflow in the Microsoft Office MSODataSourceControl ActiveX object allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long argument to the DeleteRecordSourceIfUnused method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-19T22:00:00.000Z
CVE-2007-3283 
GNOME XScreenSaver in Sun Solaris 8 and 9 before 20070417, when root is logged into the console, does not automatically lock the screen after a session has been inactive, which might allow physically proximate attackers to access the console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-19T22:00:00.000Z
CVE-2007-3284 
corefoundation.dll in Apple Safari 3.0.1 (552.12.2) for Windows allows remote attackers to cause a denial of service (crash) via certain forms that trigger errors related to History, possibly involving multiple form fields with the same name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-19T22:00:00.000Z
CVE-2007-3285 
Mozilla Firefox before 2.0.0.5, when run on Windows, allows remote attackers to bypass file type checks and possibly execute programs via a (1) file:/// or (2) resource: URI with a dangerous extension, followed by a NULL byte (%00) and a safer extension, which causes Firefox to treat the requested file differently than Windows would.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T19:00:00.000Z
CVE-2007-3286 
Multiple buffer overflows in unspecified ActiveX controls in COM objects in Avaya IP Softphone R5.2 before SP3, and R6.0, allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-19T18:00:00.000Z
CVE-2007-3288 
Cross-site scripting (XSS) vulnerability in the skeltoac stats (Automattic Stats) 1.0 plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3289 
PHP remote file inclusion vulnerability in spaw/spaw_control.class.php in the WiwiMod 0.4 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter.  NOTE: this issue is probably a duplicate of CVE-2006-4656.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3290 
categoria.php in LiveCMS 3.4 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the cid parameter, which reveals the path in a forced SQL error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3291 
Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via an article name, possibly involving the titulo parameter in article.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3292 
Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3293 
SQL injection vulnerability in categoria.php in LiveCMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3294 
Multiple buffer overflows in libtidy, as used in the Tidy extension for PHP 5.2.3 and possibly other products, allow context-dependent attackers to execute arbitrary code via (1) a long second argument to the tidy_parse_string function or (2) an unspecified vector to the tidy_repair_string function.  NOTE: this might only be an issue in environments where vsnprintf is implemented as a wrapper for vsprintf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3295 
Directory traversal vulnerability in Yet another Bulletin Board (YaBB) 2.1 and earlier allows remote authenticated users to execute arbitrary Perl code via a .. (dot dot) in the userlanguage profile setting, which sets the userlanguage key of the member hash, and is propagated to the language variable in (1) HelpCentre.pl and (2) ICQPager.pl, (3) the use_lang variable in Subs.pl, and the actlang variable in (4) Post.pl and (5) InstantMessage.pl; as demonstrated by pointing userlanguage to the English folder, modifying English/HelpCentre.lng file to contain Perl statements, and then invoking the help action in YaBB.pl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3296 
The ThunderServer.webThunder.1 ActiveX control in xunlei Web Thunderbolt 1.7.3.109 allows remote attackers to download arbitrary files and conduct other unauthorized actions by invoking dangerous methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3297 
Multiple PHP remote file inclusion vulnerabilities in Musoo 0.21 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[ini_array][EXTLIB_PATH] parameter to (1) msDb.php, (2) modules/MusooTemplateLite.php, or (3) modules/SoundImporter.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T21:00:00.000Z
CVE-2007-3298 
SQL injection vulnerability in Spey before 0.4.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to MessageProcessor.cc and possibly other components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2007-3299 
Cross-site scripting (XSS) vulnerability in AWFFull before 3.7.4, when AllSearchStr (aka the All Search Terms report) is enabled, allows remote attackers to inject arbitrary web script or HTML via a search string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2007-3300 
Multiple F-Secure anti-virus products for Microsoft Windows and Linux before 20070619 allow remote attackers to bypass scanning via a crafted header in a (1) LHA or (2) RAR archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2007-3301 
SQL injection vulnerability in forum/include/error/autherror.cfm in FuseTalk allows remote attackers to execute arbitrary SQL commands via the errorcode parameter.  NOTE: a patch may have been released privately between April and June 2007.  NOTE: this issue may overlap CVE-2007-3273.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2007-3302 
The CallCode ActiveX control in caller.dll 3.0 before 20070713, and 3.0 SP1 before 3.0.5.81, in CA (formerly Computer Associates) eTrust Intrusion Detection allows remote attackers to load arbitrary DLLs on a client system, and execute code from these DLLs, via unspecified "scriptable functions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-26T00:00:00.000Z
CVE-2007-3303 
Apache httpd 2.0.59 and 2.2.4, with the Prefork MPM module, allows local users to cause a denial of service via certain code sequences executed in a worker process that (1) stop request processing by killing all worker processes and preventing creation of replacements or (2) hang the system by forcing the master process to fork an arbitrarily large number of worker processes.  NOTE: This might be an inherent design limitation of Apache with respect to worker processes in hosted environments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2007-3304 
Apache httpd 1.3.37, 2.0.59, and 2.2.4 with the Prefork MPM module, allows local users to cause a denial of service by modifying the worker_score and process_score arrays to reference an arbitrary process ID, which is sent a SIGUSR1 signal from the master process, aka "SIGUSR1 killer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-20T22:00:00.000Z
CVE-2007-3305 
Heap-based buffer overflow in Cerulean Studios Trillian 3.x before 3.1.6.0 allows remote attackers to execute arbitrary code via a message sent through the MSN protocol, or possibly other protocols, with a crafted UTF-8 string, which triggers improper memory allocation for word wrapping when a window width is used as a buffer size, a different vulnerability than CVE-2007-2478.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T00:38:00.000Z
CVE-2007-3306 
PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL in the config[include_dir] parameter, a different vector than CVE-2006-4489.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T00:38:00.000Z
CVE-2007-3307 
SQL injection vulnerability in game_listing.php in Solar Empire 2.9.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T00:38:00.000Z
CVE-2007-3308 
Simple Machines Forum (SMF) 1.1.2 uses a concatenation method with insufficient randomization when creating a WAV file CAPTCHA, which allows remote attackers to pass the CAPTCHA test via an automated brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T00:38:00.000Z
CVE-2007-3309 
Unspecified vulnerability in Simple Machines Forum (SMF) 1.1.2 allows remote attackers to execute arbitrary PHP code during (1) creation or (2) editing of a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T00:38:00.000Z
CVE-2007-3310 
Cross-site scripting (XSS) vulnerability in arama.asp in TDizin allows remote attackers to inject arbitrary web script or HTML via the ara parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T00:38:00.000Z
CVE-2007-3311 
SQL injection vulnerability in print.php in the Articles 1.02 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T10:00:00.000Z
CVE-2007-3312 
Directory traversal vulnerability in admin/plugin_manager.php in Jasmine CMS 1.0 allows remote authenticated administrators to include and execute arbitrary local files a .. (dot dot) in the u parameter. NOTE: a separate vulnerability could be leveraged to make this issue exploitable by remote unauthenticated attackers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3313 
Multiple SQL injection vulnerabilities in Jasmine CMS 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the login_username parameter to login.php or (2) the item parameter to news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3314 
Stack-based buffer overflow in peviewer.spl in Altap Servant Salamander 2.5 with Portable Executable Viewer 2.02 (English Trial), and 2.0 with Portable Executable Viewer 1.00 (English Trial), allows remote attackers to execute arbitrary code via a long PDB debug filename in a PE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3315 
Multiple PHP remote file inclusion vulnerabilities in YourFreeScreamer 1.0, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the serverPath parameter to bodyTemplate.php in (1) templates/Classic/, (2) templates/Classic Guestbook/, (3) templates/DarkNights/, and (4) templates/Simplistic/, different vectors than CVE-2007-3271.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3316 
Multiple format string vulnerabilities in plugins in VideoLAN VLC Media Player before 0.8.6c allow remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in (1) an Ogg/Vorbis file, (2) an Ogg/Theora file, (3) a CDDB entry for a CD Digital Audio (CDDA) file, or (4) Service Announce Protocol (SAP) multicast packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3317 
The Session Initiation Protocol (SIP) User Access Client (UAC) message parsing module in Avaya one-X Desktop Edition 2.1.0.70 and earlier allows remote attackers to cause a denial of service (device crash) via a malformed SIP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3318 
Buffer overflow in the Session Initiation Protocol (SIP) User Access Client (UAC) message parsing module in Avaya one-X Desktop Edition 2.1.0.70 and earlier allows remote attackers to cause a denial of service (call reception outage) via a malformed SIP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3319 
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3320 
The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware accepts SIP INVITE requests from arbitrary source IP addresses, which allows remote attackers to have an unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3321 
The Avaya 4602 SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware allows remote attackers to cause a denial of service (device reboot) via a flood of packets to the BOOTP port (68/udp).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3322 
The Avaya 4602 SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware uses a constant media port number for calls, which allows remote attackers to cause a denial of service (audio quality loss) via a flood of packets to the RTP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3323 
SQL injection vulnerability in comersus_optReviewReadExec.asp in Comersus Shop Cart 7.07 allows remote attackers to execute arbitrary SQL commands via the idProduct parameter.  NOTE: this might be the same as CVE-2005-2190.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3324 
Multiple cross-site scripting (XSS) vulnerabilities in Comersus Cart 7.07 allow remote attackers to inject arbitrary web script or HTML via the redirectUrl parameter to (1) comersus_customerAuthenticateForm.asp or (2) comersus_message.asp, different vectors than CVE-2004-0681.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3325 
PHP remote file inclusion vulnerability in lib/language.php in LAN Management System (LMS) 1.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _LIB_DIR parameter, a different vector than CVE-2007-1643 and CVE-2007-2205.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3326 
Multiple directory traversal vulnerabilities in vBulletin 3.x.x allow remote attackers to redirect visitors to arbitrary local files via a .. (dot dot) in (1) the loc parameter to admincp/index.php and (2) the Hyperlink information URl field for post Topic in showthread.php, enabling cross-site scripting (XSS) and other attacks, a different vulnerability than CVE-2005-3025.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3327 
httpsv.exe in HTTP Server 1.6.2 allows remote attackers to obtain sensitive information (script source code) via a URI with a trailing %20 (encoded space).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3328 
Multiple cross-site scripting (XSS) vulnerabilities in Interact 2.4 beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) module_key parameter to (a) kb/kb.php, (b) quiz/runquiz.php, (c) quiz/quiz.php, (d) forum/forum.php, (e) forum/byname.php, and (f) journal/journalview.php in modules/, and unspecified other scripts; the (2) tag_key parameter to modules/journal/journalview.php; the (3) user_group_key parameter to (g) users/secureaccounts.php; and (4) the request_uri parameter to (h) login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3329 
Multiple array index errors in the (1) get_intra_block, (2) get_inter_block_h263, and (3) get_inter_block_mpeg functions in src/bitstream/mbcoding.c in Xvid 1.1.2 allow remote attackers to execute arbitrary code via a crafted (a) Avi, (b) H.263, or (c) MPEG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3330 
Cross-site scripting (XSS) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to inject arbitrary web script or HTML via a news post, which is stored in news/ without sanitization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3331 
Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to change the admin password via (1) a certain HTML form that is posted automatically by JavaScript or (2) a news post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T18:00:00.000Z
CVE-2007-3332 
Directory traversal vulnerability in Satellite.php in Satel Lite for PhpNuke allows remote attackers to read arbitrary files via a .. (dot dot) sequence in the name parameter in a modload action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T19:00:00.000Z
CVE-2007-3333 
Stack-based buffer overflow in capture in IBM AIX 5.3 SP6 and 5.2.0 allows remote attackers to execute arbitrary code via a large number of terminal control sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-26T22:00:00.000Z
CVE-2007-3334 
Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe) components for Ingres Database Server 3.0.3, as used in CA (Computer Associates) products including eTrust Secure Content Manager r8 on Windows, allow remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T22:00:00.000Z
CVE-2007-3335 
Multiple SQL injection vulnerabilities in the admin panel in PHPEcho CMS before 1.6 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T19:00:00.000Z
CVE-2007-3336 
Multiple "pointer overwrite" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associates) products, allow remote attackers to execute arbitrary code by sending certain TCP data at different times to the Ingres Communications Server Process (iigcc), which calls the (1) QUinsert or (2) QUremove functions with attacker-controlled input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3337 
wakeup in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allows local users to truncate arbitrary files via a symlink attack on the alarmwkp.def file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3338 
Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allow remote attackers to execute arbitrary code via the (1) uuid_from_char or (2) duve_get_args functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2007-3339 
Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the (1) FTVAR_LINKP and (2) FTVAR_URLP parameters to (a) forum/include/error/autherror.cfm, and the (3) FTVAR_SCRIPTRUN parameter to (b) forum/include/common/comfinish.cfm and (c) blog/include/common/comfinish.cfm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T21:00:00.000Z
CVE-2007-3340 
BugHunter HTTP SERVER (httpsv.exe) 1.6.2 allows remote attackers to cause a denial of service (application crash) via a large number of requests for nonexistent pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T22:00:00.000Z
CVE-2007-3341 
Unspecified vulnerability in the FTP implementation in Microsoft Internet Explorer allows remote attackers to "see a valid memory address" via unspecified vectors, a different issue than CVE-2007-0217.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-21T23:00:00.000Z