rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-6973 
Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities, which allows remote attackers to (1) reinstall the application via a direct request for install/index.php; (2) delete the database via a do=delete_database QUERY_STRING to a renamed copy of install/index.php; or access the administration system, after guessing a filename, via a direct request for a file in (3) admin/ or (4) tech/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-07T20:00:00.000Z
CVE-2006-6974 
Headstart Solutions DeskPRO stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) list files in the includes/ directory; obtain the SQL username and password via a direct request for (2) config.php and (3) config.php.bak in includes/; read files in (4) email/, (5) admin/graphs/, (6) includes/javascript/, and (7) certain other includes/ directories via direct requests; and download SQL database data via direct requests for (8) data.sql, (9) install.sql, (10) settings.sql, and possibly other files in install/v2data/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-07T20:00:00.000Z
CVE-2006-6975 
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote attackers to execute arbitrary code via a URL in the class_pwd parameter.  NOTE: this issue has been disputed by CVE and multiple third parties, who state that $class_pwd is set to a static value before the relevant include statement
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T17:00:00.000Z
CVE-2006-6976 
PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.2 and earlier allows remote attackers to execute arbitrary code via a URL in the absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T17:00:00.000Z
CVE-2006-6977 
Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FreeTextBox allows remote attackers to execute arbitrary JavaScript via the javascript: URI in the (1) href or (2) onmouseover attribute of the A HTML tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T17:00:00.000Z
CVE-2006-6978 
Cross-site scripting (XSS) vulnerability in the "Basic Toolbar Selection" in FCKEditor allows remote attackers to execute arbitrary JavaScript via the javascript: URI in the (1) href or (2) onmouseover attribute of the A HTML tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T17:00:00.000Z
CVE-2006-6979 
The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T18:00:00.000Z
CVE-2006-6980 
The magnatune.com album browser in Amarok allows attackers to cause a denial of service (application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T18:00:00.000Z
CVE-2006-6981 
3proxy 0.5 to 0.5.2, when NT-encoded passwords are being used, allows remote attackers to cause a denial of service (blocked account) via unspecified vectors related to NTLM authentication, which causes a password hash to be overwritten.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T18:00:00.000Z
CVE-2006-6982 
3proxy 0.5 to 0.5.2 does not offer NTLM authentication before basic authentication, which might cause browsers with incomplete RFC2616/RFC2617 support to use basic cleartext authentication even if NTLM is available, which makes it easier for attackers to steal credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-08T18:00:00.000Z
CVE-2006-6983 
Cross-domain vulnerability in MYweb4net Browser 3.8.8.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6984 
Cross-domain vulnerability in GreenBrowser 3.4.0622 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6985 
Cross-domain vulnerability in Maxthon 1.5.6 build 42 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6986 
Cross-domain vulnerability in PhaseOut 5.4.4 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6987 
Cross-domain vulnerability in FineBrowser Freeware 3.2.2 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6988 
Cross-domain vulnerability in Slim Browser 4.07 build 100 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6989 
Cross-domain vulnerability in NetCaptor 4.5.7 Personal Edition allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6990 
Cross-domain vulnerability in Enigma Browser 3.8.8 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6991 
Cross-domain vulnerability in Fast Browser Pro 8.1 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6992 
Cross-domain vulnerability in GoSuRF Browser 2.62 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, a similar vulnerability to CVE-2006-3280.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-09T01:00:00.000Z
CVE-2006-6993 
Multiple SQL injection vulnerabilities in pages/addcomment2.php in Neuron Blog 1.1 allow remote attackers to inject arbitrary SQL commands via the (1) commentname, (2) commentmail, (3) commentwebsite, and (4) comment parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T11:00:00.000Z
CVE-2006-6994 
Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery, possibly 2.0 and earlier, allows remote attackers to upload and execute arbitrary ASP files by removing the client-side security checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T11:00:00.000Z
CVE-2006-6995 
mycontacts.php in V3 Chat allows remote authenticated users to gain privileges as other users via a modified membername parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T11:00:00.000Z
CVE-2006-6996 
Multiple cross-site scripting (XSS) vulnerabilities in warforge.NEWS 1.0 allow remote attackers to inject arbitrary HTML and web script via the (1) title and (2) newspost parameters to (a) newsadd.php, and the (3) name, title, and (4) comment parameters to (b) news.php, a different set of vectors than CVE-2006-1818.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T11:00:00.000Z
CVE-2006-6997 
Unspecified vulnerability in a cryptographic feature in MailEnable Standard Edition before 1.93, Professional Edition before 1.73, and Enterprise Edition before 1.21 leads to "weakened authentication security" with unknown impact and attack vectors.  NOTE: due to lack of details, it is not clear whether this is the same as CVE-2006-1792.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T11:00:00.000Z
CVE-2006-6998 
install/loader_help.php in Headstart Solutions DeskPRO allows remote attackers to obtain configuration information via a q=phpinfo QUERY_STRING, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T17:00:00.000Z
CVE-2006-6999 
attachment.php in Headstart Solutions DeskPRO allows remote attackers to read all uploaded files by providing the file number in a modified id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T17:00:00.000Z
CVE-2006-7000 
Headstart Solutions DeskPRO allows remote attackers to obtain the full path via direct requests to (1) email/mail.php, (2) includes/init.php, (3) certain files in includes/cron/, and (4) jpgraph.php, (5) jpgraph_bar.php, (6) jpgraph_pie.php, and (7) jpgraph_pie3d.php in includes/graph/, which leaks the path in error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T17:00:00.000Z
CVE-2006-7001 
Directory traversal vulnerability in avatar.php in PhpMyChat Plus 1.9 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the L parameter, a different issue than CVE-2006-5897. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T19:00:00.000Z
CVE-2006-7002 
Cross-site scripting (XSS) vulnerability in add_comment.php in Wheatblog (wB) 1.1 allows remote attackers to inject arbitrary web script or HTML via the Email field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.  NOTE: this issue may overlap CVE-2006-5195.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T19:00:00.000Z
CVE-2006-7003 
PHP remote file inclusion vulnerability in admin/index.php in Fusion Polls allows remote attackers to execute arbitrary PHP code via a URL in the xtrphome parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7004 
Cross-site scripting (XSS) vulnerability in email_request.php in PSY Auction allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7005 
SQL injection vulnerability in item.php in PSY Auction allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7006 
PHP remote file inclusion vulnerability in upload/admin/team.php in Robin de Graff Somery 0.4.4 allows remote attackers to execute arbitrary PHP code via a URL in the checkauth parameter.  NOTE: CVE disputes this vulnerability because the checkauth parameter is only used in conditionals
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7007 
Buffer overflow in Tiny FTPd 1.4 and earlier allows remote attackers to cause a denial of service (daemon crash) via a long USER command, a different vector than CVE-2000-0133.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7008 
Unspecified vulnerability in Joomla! before 1.0.10 has unknown impact and attack vectors, related to "securing mosmsg from misuse." NOTE: it is possible that this issue overlaps CVE-2006-1029.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7009 
Joomla! before 1.0.10 allows remote attackers to spoof the frontend submission forms, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7010 
The mosgetparam implementation in Joomla! before 1.0.10, does not set a variable's data type to integer when the variable's default value is numeric, which has unspecified impact and attack vectors, which may permit SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-12T23:00:00.000Z
CVE-2006-7011 
PHP remote file inclusion vulnerability in adminips.php in Develooping Flash Chat allows remote attackers to execute arbitrary PHP code via a URL in the banned_file parameter.  NOTE: CVE disputes this vulnerability because banned_file is set to a constant value
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7012 
scart.cgi in SCart 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter of a show_text action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7013 
QueryString.php in Simple Machines Forum (SMF) 1.0.7 and earlier, and 1.1rc2 and earlier, allows remote attackers to more easily spoof the IP address and evade banning via a modified X-Forwarded-For HTTP header, which is preferred instead of other more reliable sources for the IP address.  NOTE: the original researcher claims that the vendor has disputed this issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7014 
admin.php in BloggIT 1.01 and earlier does not properly establish a user session, which allows remote attackers to gain privileges via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7015 
PHP remote file inclusion vulnerability in admin.jobline.php in Jobline 1.1.1 allows remote attackers to execute arbitrary code via a URL in the mosConfig_absolute_path parameter.  NOTE: CVE disputes this issue because the script is protected against direct requests
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7016 
phpjobboard allows remote attackers to bypass authentication and gain administrator privileges via a direct request to admin.php with adminop=job-edit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7017 
Multiple PHP remote file inclusion vulnerabilities in Indexu 5.0.1 allow remote attackers to execute arbitrary PHP code via a URL in the admin_template_path parameter to admin/ scripts (1) app_change_email.php, (2) app_change_pwd.php, (3) app_mod_rewrite.php, (4) app_page_caching.php, (5) app_setup.php, (6) cat_add.php, (7) cat_delete.php, (8) cat_edit.php, (9) cat_path_update.php, (10) cat_search.php, (11) cat_struc.php, (12) cat_view.php, (13) cat_view_hidden.php, (14) cat_view_hierarchy.php, (15) cat_view_registered_only.php, (16) checkurl_web.php, (17) db_alter.php, (18) db_alter_change.php, (19) db_backup.php, (20) db_export.php, (21) db_import.php, (22) editor_add.php, (23) editor_delete.php, (24) editor_validate.php, (25) head.php, (26) index.php, (27) inv_config.php, (28) inv_config_payment.php, (29) inv_create.php, (30) inv_delete.php, (31) inv_edit.php, (32) inv_markpaid.php, (33) inv_markunpaid.php, (34) inv_overdue.php, (35) inv_paid.php, (36) inv_send.php, (37) inv_unpaid.php, (38) lang_modify.php, (39) link_add.php, (40) link_bad.php, (41) link_bad_delete.php, (42) link_checkurl.php, (43) link_delete.php, (44) link_duplicate.php, (45) link_edit.php, (46) link_premium_listing.php, (47) link_premium_sponsored.php, (48) link_search.php, (49) link_sponsored_listing.php, (50) link_validate.php, (51) link_validate_edit.php, (52) link_view.php, (53) log_search.php, (54) mail_modify.php, (55) menu.php, (56) message_create.php, (57) message_delete.php, (58) message_edit.php, (59) message_send.php, (60) message_subscriber.php, (61) message_view.php, (62) review_validate.php, (63) review_validate_edit.php, (64) summary.php, (65) template_active.php, (66) template_add_custom.php, (67) template_delete.php, (68) template_delete_file.php, (69) template_duplicate.php, (70) template_export.php, (71) template_import.php, (72) template_manager.php, (73) template_modify.php, (74) template_modify_file.php, (75) template_rename.php, (76) user_add.php, (77) user_delete.php, (78) user_edit.php, (79) user_search.php, and (80) whos.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7018 
phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via a crafted argument to the nome_evento parameter to phpwcms_code_snippets/mail_file_form.php and (2) sample_ext_php/mail_file_form.php, which is processed by the render_PHPcode function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7019 
phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to execute arbitrary code via crafted arguments to the (1) text_evento and (2) email_eventonome_evento parameters to phpwcms_code_snippets/mail_file_form.php and sample_ext_php/mail_file_form.php, which is processed by the render_PHPcode function.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7020 
CRLF injection vulnerability in (1) include/inc_act/act_formmailer.php and possibly (2) sample_ext_php/mail_file_form.php in phpwcms 1.2.5-DEV and earlier, and 1.1 before RC4, allows remote attackers to modify HTTP headers and send spam e-mail via a spoofed HTTP Referer (HTTP_REFERER).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7021 
PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS 1.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7022 
The Tools module in fx-APP 0.0.8.1 allows remote attackers to misrepresent the contents of a web page via an arbitrary URL in the url parameter to a showhtml action for index.php, which causes the URL to be displayed within an iframe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7023 
Multiple cross-site scripting (XSS) vulnerabilities in fx-APP 0.0.8.1 allow remote attackers to inject arbitrary HTML or web script via (1) the search box, and the (2) url, (3) website, (4) comment, and (5) signature fields in the profile, and possibly (6) a menu item.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7024 
Multiple PHP remote file inclusion vulnerabilities in Harpia CMS 1.0.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) func_prog parameter to (a) preload.php and (b) index.php; (2) header_prog parameter to (c) missing.php and (d) email.php, (e) files.php, (f) headlines.php, (g) search.php, (h) topics.php, and (i) users.php in _mods/; (3) theme_root parameter to (j) footer.php, (k) header.php, (l) pfooter.php, and (m) pheader.php in _inc; (4) mod_root parameter to _inc/header.php; and the (5) mod_dir and (6) php_ext parameters to (n) _inc/web_statsConfig.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-15T02:00:00.000Z
CVE-2006-7025 
SQL injection vulnerability in admin/config.php in Bookmark4U 2.0 and 2.1 allows remote attackers to inject arbitrary SQL command via the sqlcmd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-02-23T01:00:00.000Z