rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-4491 
Multiple cross-site scripting (XSS) vulnerabilities in Sitekit CMS 6.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) query string, (2) textonly, (3) locID, and (4) lang parameters to (a) Default.aspx, and the (6) ClickFrom parameter to (b) Request-call-back.html and (c) registration-form.html.  NOTE: the vendor states "This issue was resolved by a minor update to Sitekit CMS v6.6, sanitising the html code and eradicating related security issues."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4492 
Cross-site scripting (XSS) vulnerability in Starphire SiteSage 5.0.18 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the norelay_highlight_words parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4493 
Cross-site scripting (XSS) vulnerability in SpearTek 6.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4494 
Cross-site scripting (XSS) vulnerability in SPIP 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) spip_login.php3 and (2) spip_pass.php3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4495 
SQL injection vulnerability in index.cfm in SpireMedia mx7 allows remote attackers to execute arbitrary SQL commands via the cid parameter.  NOTE: the vendor has disputed this issue, stating "This information is incorrect, unproven, and potentially slanderous." However, CVE and OSVDB have both performed additional research that suggests that this might be path disclosure from invalid SQL syntax
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4496 
Cross-site scripting (XSS) vulnerability in search in SyntaxCMS 1.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the search_query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4497 
Cross-site scripting (XSS) vulnerability in Tangora Portal CMS 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the action parameter in a search page, as demonstrated using (1) page1631.aspx and (2) page496.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4498 
Cross-site scripting (XSS) vulnerability in Text-e 1.6.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4499 
The Downloadable RADIUS ACLs feature in Cisco PIX and VPN 3000 concentrators, when creating an ACL on the Cisco Secure Access Control Server (CS ACS), generates a random internal name for an ACL that is also used as a hidden user name and password, which allows remote attackers to gain privileges by sniffing the username from the cleartext portion of a RADIUS session, then using the password to log in to another device that uses CS ACS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T11:00:00.000Z
CVE-2005-4500 
SQL injection vulnerability in MusicBox 2.3 allows remote attackers to execute arbitrary SQL commands via the (1) show and (2) type parameter.  NOTE: the provenance of this information is unknown, although it was later rediscovered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T21:00:00.000Z
CVE-2005-4501 
MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T21:00:00.000Z
CVE-2005-4502 
Cross-site scripting (XSS) vulnerability in httprint v202, and possibly other versions before v301, allows remote attackers to inject arbitrary web script or HTML via the Server field in an HTTP response, which is not sanitized before being displayed to the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T21:00:00.000Z
CVE-2005-4503 
httprint v202, and possibly other versions before v301, allows remote attackers to cause a denial of service (crash) via a long Server field in an HTTP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T21:00:00.000Z
CVE-2005-4504 
The khtml::RenderTableSection::ensureRows function in KHTMLParser in Apple Mac OS X 10.4.3 and earlier, as used by Safari and TextEdit, allows remote attackers to cause a denial of service (memory consumption and application crash) via HTML files with a large ROWSPAN attribute in a TD tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-22T23:00:00.000Z
CVE-2005-4505 
Unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i (patch 11) and CMA 3.5 (patch 5) might allow local users to gain privileges via a malicious "program.exe" file in the C: folder, which is run by naPrdMgr.exe when it attempts to execute EntVUtil.EXE under an unquoted "Program Files" path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T00:00:00.000Z
CVE-2005-4506 
Nexus Concepts Dev Hound 2.24 and earlier stores username and password information in cleartext in the devhound.tdbd file, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T00:00:00.000Z
CVE-2005-4507 
Multiple cross-site scripting (XSS) vulnerabilities in Nexus Concepts Dev Hound 2.24 and earlier allow remote attackers to inject arbitrary web script or HTML via multiple unspecified user input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T00:00:00.000Z
CVE-2005-4508 
Nexus Concepts Dev Hound 2.24 and earlier allows remote attackers to obtain the installation path via a URL containing a non-existent .dll file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T00:00:00.000Z
CVE-2005-4509 
SQL injection vulnerability in index.asp in pTools allows remote attackers to execute arbitrary SQL commands via the docID parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T01:00:00.000Z
CVE-2005-4510 
Directory traversal vulnerability in server.np in NetPublish Server 7 allows remote attackers to read arbitrary files via "../" sequences in the template parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T01:00:00.000Z
CVE-2005-4511 
Format string vulnerability in TN3270 Resource Gateway 1.1.0 allows local users to cause a denial of service and possibly execute arbitrary code via format string specifiers in syslog function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T01:00:00.000Z
CVE-2005-4512 
Cross-site scripting (XSS) vulnerability in WAXTRAPP 3.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T01:00:00.000Z
CVE-2005-4513 
Cross-site scripting (XSS) vulnerability in WANDSOFT e-SEARCH allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T01:00:00.000Z
CVE-2005-4514 
The encapsulation script mechanism in Webwasher CSM Appliance Suite 5.x uses case-sensitive detection of malicious tokens, which allows attackers to bypass script detection by using tokens that can be upper or lower case.  NOTE: the vendor has stated that this problem could not be reproduced, and has asked the researcher for more information, without a response as of 20060103
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T01:00:00.000Z
CVE-2005-4515 
SQL injection vulnerability in WebDB 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified search parameters, possibly Search0.  NOTE: the vendor has disputed this issue, saying that "WebDB is a generic online database system used by many of the clients of Lois Software. The flaw that was identified was some code that was added for a client to do some testing of his system and only certain safe commands were allowed. This code has now been removed and it is not now possible to use SQL queries as part of the query string.  No installation or patch is required All clients use a common code library and have their own front end and databases and connections. So as soon as a change / upgrade / enhancement is made to the code, all users of the software begin to use the latest changes immediately."  Since the issue appeared in a custom web site and no action is required on the part of customers, this issue should not be included in CVE
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-23T01:00:00.000Z
CVE-2005-4516 
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion 6.00.200 through 6.00.300 allow remote attackers to inject arbitrary web script or HTML via (1) the sortby parameter in members.php and (2) IMG tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4517 
SQL injection vulnerability in PHP-Fusion 6.00.200 through 6.00.300 allows remote attackers to execute arbitrary SQL commands via the ratings parameter in multiple scripts, such as ratings_include.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4518 
Mantis before 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the max_file_size parameter to (1) bug_file_add.php, (2) bug_report.php, (3) bug_report_advanced_page.php, and (4) proj_doc_add_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4519 
Multiple SQL injection vulnerabilities in the manage user page (manage_user_page.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prefix and (2) sort parameters to the manage user page (manage_user_page.php), or (3) the sort parameter to view_all_set.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4520 
Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors.  NOTE: due to a lack of relevant details in the vendor changelog, which is the source of this description, it is unclear whether this is a duplicate of another CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4521 
CRLF injection vulnerability in Mantis 1.0.0rc3 and earlier allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via (1) the return parameter in login_cookie_test.php and (2) ref parameter in login_select_proj_page.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4522 
Multiple cross-site scripting (XSS) vulnerabilities in the view_filters_page.php filters script in Mantis 1.0.0rc3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) view_type and (2) target_field parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4523 
Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4524 
Mantis 1.0.0rc3 does not properly handle "Make note private" when a bug is being resolved, which has unknown impact and attack vectors, probably related to an information leak.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4525 
SmcGui.exe in Sygate Protection Agent 5.0 build 6144 allows local users to obtain management control over the agent by executing the GUI (SmcGui.exe) and then killing the process, which causes the privileged management GUI to launch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4526 
Clearswift MIMEsweeper For Web (a.k.a. WEBsweeper) 4.0 through 5.1 allows remote attackers to bypass filtering via a URL that does not include a .exe extension but returns an executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4527 
Multiple SQL injection vulnerabilities in Direct News 4.9 allow remote attackers to execute arbitrary SQL commands via (1) the setLang parameter in index.php and (2) unspecified search module parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4528 
SQL injection vulnerability in the Chatspot 2.0.0a7 module for phpBB allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4529 
The Chatspot 2.0.0a7 module for phpBB might allow remote attackers to impersonate other users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4530 
Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft EPay Enterprise 3.0 (formerly DoPays) allow remote attackers to inject arbitrary web script or HTML via multiple unspecified parameters in (1) profile.htm, (2) card.htm, (3) bank.htm, (4) subscriptions.htm, (5) send.htm, (6) request.htm, (7) forgot.htm, (8) escrow.htm, (9) donations.htm, and (10) products.htm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4532 
scponlyc in scponly 4.1 and earlier, when the operating system supports LD_PRELOAD mechanisms, allows local users to execute arbitrary code with root privileges by creating a chroot directory in their home directory, hard linking to a system setuid application, and using a modified LD_PRELOAD to modify expected function calls in the setuid application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4533 
Argument injection vulnerability in scponlyc in scponly 4.1 and earlier, when both scp and rsync compatibility are enabled, allows local users to execute arbitrary applications via "getopt" style argument specifications, which are not filtered.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T01:00:00.000Z
CVE-2005-4534 
The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T02:00:00.000Z
CVE-2005-4536 
Mail::Audit module in libmail-audit-perl 2.1-5, when logging is enabled without a default log file specified, uses predictable log filenames, which allows local users to overwrite arbitrary files via a symlink attack on the [PID]-audit.log temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-02-01T22:00:00.000Z
CVE-2005-4545 
Cross-site scripting (XSS) vulnerability in search.asp in NetDirect ShopEngine allows remote attackers to inject arbitrary web script or HTML via the EXPS parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4546 
search.php in eggblog 2.0 allows remote attackers to obtain the full path via an invalid q parameter, as used by the Keyword and Search fields, possibly due to an SQL injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4547 
Cross-site scripting (XSS) vulnerability in home/search.php in eggblog 2.0 allows remote attackers to execute arbitrary SQL commands via the q parameter, as used by the Keyword and Search fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4548 
SQL injection vulnerability in the "user area" in RWS Statistics Counter before 2.4.1 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4549 
Cross-site scripting (XSS) vulnerability in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to inject arbitrary web script or HTML via the (1) RowKeyValue parameter in the PORTAL schema; and the (2) title and (3) content input fields when creating an forum article.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4550 
The PORTAL schema in Oracle Application Server (OracleAS) Discussion Forum Portlet allows remote attackers to obtain the source code for arbitrary JSP and other files via a df_next_page parameter with a trailing null byte (%00).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4551 
Cross-site scripting (XSS) vulnerability in sign.php in codegrrl SimpBook 1.0, when html_enable is on, allows remote attackers to inject arbitrary web script or HTML via the message parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4552 
The (1) slsmgr and (2) slsadmin programs in Sun Solaris PC NetLink 2.0 create temporary files insecurely, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4553 
Buffer overflow in Golden FTP Server 1.92 allows remote attackers to execute arbitrary code via a long APPE command.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4554 
Multiple SQL injection vulnerabilities in DEV web management system 1.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter in an openforum action (openforum.php) in index.php, (2) cat parameter in getfile.php, and (3) target parameter in download_now.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4555 
Cross-site scripting (XSS) vulnerability in add.php in DEV web management system 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) ENTER_ARTICLE_TITLE, (2) SPECIFY_ZONE, (3) ENTER_ARTICLE_HEADER, and (4) ENTER_ARTICLE_BODY indices in the language array parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4556 
PHP remote file include vulnerability in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, when register_globals is enabled, allows remote attackers to include arbitrary local and remote PHP files via a URL in the (1) lang_settings and (2) language parameters in (a) accounts/inc/include.php and (b) admin/inc/include.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4557 
dir/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, allows remote attackers to include arbitrary local files via a null byte (%00) in the lang parameter, possibly due to a directory traversal vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4558 
IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly restrict acceptable values for the language parameter to mail/settings.html before it is stored in a database, which can allow remote authenticated users to include arbitrary PHP code via a URL in a modified lang_settings parameter to mail/index.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4559 
mail/include.html in IceWarp Web Mail 5.5.1, as used by Merak Mail Server 8.3.0r and VisNetic Mail Server version 8.3.0 build 1, does not properly initialize the default_layout and layout_settings variables when an unrecognized HTTP_USER_AGENT string is provided, which allows remote attackers to access arbitrary files via a request with an unrecognized User Agent that also specifies the desired default_layout and layout_settings parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T11:00:00.000Z
CVE-2005-4560 
The Windows Graphical Device Interface library (GDI32.DLL) in Microsoft Windows allows remote attackers to execute arbitrary code via a Windows Metafile (WMF) format image with a crafted SETABORTPROC GDI Escape function call, related to the Windows Picture and Fax Viewer (SHIMGVW.DLL), a different vulnerability than CVE-2005-2123 and CVE-2005-2124, and as originally discovered in the wild on unionseek.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-28T19:00:00.000Z
CVE-2005-4563 
SQL injection vulnerability in main.php in Enterprise Heart Enterprise Connector 1.0.2 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the loginid parameter, a different vulnerability than CVE-2005-3875.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-29T11:00:00.000Z
CVE-2005-4564 
The Internet Key Exchange version 1 (IKEv1) implementation in ADTRAN NetVanta before 10.03.03.E might allow remote attackers to cause a denial of service via crafted IKE packets, as demonstrated by the PROTOS ISAKMP Test Suite for IKEv1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-29T11:00:00.000Z