rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-3363 
SQL injection vulnerability in Saphp Lesson, possibly saphp Lesson1.1 and saphpLesson2.0, allows remote attackers to execute arbitrary SQL commands via the forumid parameter in (1) showcat.php and (2) add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3364 
Multiple SQL injection vulnerabilities in DboardGear allow remote attackers to execute arbitrary SQL commands via (1) the buddy parameter in buddy.php, (2) the u2uid parameter in u2u.php, and (3) an invalid theme file in the themes action to ctrtools.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3365 
Multiple SQL injection vulnerabilities in DCP-Portal 6 and earlier allow remote attackers to execute arbitrary SQL commands, possibly requiring encoded characters, via (1) the name parameter in register.php, (2) the email parameter in lostpassword.php, (3) the year parameter in calendar.php, and the (4) cid parameter to index.php.  NOTE: the mid parameter for forums.php is already associated with CVE-2005-0454.  NOTE: the index.php/cid vector was later reported to affect 6.11.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3366 
PHP file inclusion vulnerability in index.php in PHP iCalendar 2.0a2 through 2.0.1 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the phpicalendar cookie.  NOTE: this is not a cross-site scripting (XSS) issue as claimed by the original researcher.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3367 
Cross-site scripting (XSS) vulnerability in journal.php in SparkleBlog 2.1 allows remote attackers to inject arbitrary web script or HTML via the name field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3368 
Cross-site scripting (XSS) vulnerability in the Search_Enhanced module in PHP-Nuke 7.9 allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3369 
Multiple SQL injection vulnerabilities in the Info-DB module (info_db.php) in Woltlab Burning Board 2.7 and earlier allow remote attackers to execute arbitrary SQL commands and possibly upload files via the (1) fileid and (2) subkatid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3370 
Multiple interpretation error in ArcaVir 2005 package 2005-06-21 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3371 
Multiple interpretation error in AVG 7 7.0.323 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3372 
Multiple interpretation error in eTrust CA 7.0.1.4 with the 11.9.1 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3373 
Multiple interpretation error in Dr.Web 4.32b allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3374 
Multiple interpretation error in F-Prot 3.16c allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3375 
Multiple interpretation error in Ikarus demo version allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3376 
Multiple interpretation error in Kaspersky 5.0.372 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3377 
Multiple interpretation error in (1) McAfee Internet Security Suite 7.1.5 version 9.1.08 with the 4.4.00 engine and (2) McAfee Corporate 8.0.0 patch 10 with the 4400 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3378 
Multiple interpretation error in Norman 5.81 with the 5.83.02 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3379 
Multiple interpretation error in Trend Micro (1) PC-Cillin 2005 12.0.1244 with the 7.510.1002 engine and (2) OfficeScan 7.0 with the 7.510.1002 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3380 
Multiple interpretation error in Panda Titanium 2005 4.02.01 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3381 
Multiple interpretation error in Ukrainian National Antivirus (UNA) 1.83.2.16 with kernel 265 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3382 
Multiple interpretation error in Sophos 3.91 with the 2.28.4 engine allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3383 
SQL injection vulnerability in Techno Dreams Announcement script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3384 
SQL injection vulnerability in Techno Dreams Guest Book script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3385 
SQL injection vulnerability in Techno Dreams Mailing List script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3386 
SQL injection vulnerability in Techno Dreams Web Directory script allows remote attackers to execute arbitrary SQL commands and bypass authentication via the userid parameter in admin/login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-10-29T19:00:00.000Z
CVE-2005-3387 
The startup script in packages/RedHat/ntop.init in ntop before 3.2, when ntop.conf is writable by users besides root, creates temporary files insecurely, which allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T02:00:00.000Z
CVE-2005-3388 
Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL with a "stacked array assignment."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T02:00:00.000Z
CVE-2005-3389 
The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an internal flag that enables register_globals and allows attackers to exploit vulnerabilities in PHP applications that would otherwise be protected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T02:00:00.000Z
CVE-2005-3390 
The RFC1867 file upload feature in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when register_globals is enabled, allows remote attackers to modify the GLOBALS array and bypass security protections of PHP applications via a multipart/form-data POST request with a "GLOBALS" fileupload field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T02:00:00.000Z
CVE-2005-3391 
Multiple vulnerabilities in PHP before 4.4.1 allow remote attackers to bypass safe_mode and open_basedir restrictions via unknown attack vectors in (1) ext/curl and (2) ext/gd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3392 
Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3393 
Format string vulnerability in the foreign_option function in options.c for OpenVPN 2.0.x allows remote clients to execute arbitrary code via format string specifiers in a push of the dhcp-option command option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3394 
Multiple SQL injection vulnerabilities in forum.php in oaboard forum 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) channel parameter in the topics module and (2) topic parameter in the posting module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3395 
SQL injection vulnerability in Invision Gallery 2.0.3 allows remote attackers to execute arbitrary SQL commands via the st parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3396 
Buffer overflow in the chcons (chcon) command in IBM AIX 5.2 and 5.3, when DEBUG MALLOC is enabled, might allow attackers to execute arbitrary code via a long command line argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3397 
Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to comersus_backoffice_supportError.asp.  NOTE: the comersus_backoffice_message.asp/message vector is already covered by CVE-2005-2191 item 2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3398 
The default configuration of the web server for the Solaris Management Console (SMC) in Solaris 8, 9, and 10 enables the HTTP TRACE method, which could allow remote attackers to obtain sensitive information such as cookies and authentication data from HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3399 
Multiple interpretation error in CAT-QuickHeal 8.0 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3400 
Multiple interpretation error in Fortinet 2.48.0.0 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3401 
Multiple interpretation error in TheHacker 5.8.4.128 allows remote attackers to bypass virus scanning via a file such as BAT, HTML, and EML with an "MZ" magic byte sequence which is normally associated with EXE, which causes the file to be treated as a safe type that could still be executed as a dangerous file type by applications on the end system, as demonstrated by a "triple headed" program that contains EXE, EML, and HTML content, aka the "magic byte bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3402 
The SMTP client in Mozilla Thunderbird 1.0.5 BETA, 1.0.7, and possibly other versions, does not notify users when it cannot establish a secure channel with the server, which allows remote attackers to obtain authentication information without detection via a man-in-the-middle (MITM) attack that bypasses TLS authentication or downgrades CRAM-MD5 authentication to plain authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3403 
Multiple cross-site scripting (XSS) vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to inject arbitrary web script or HTML via (1) the _base_href parameter in translate.php, (2) the _base_path parameter in news.inc.php, and (3) the p parameter in add_note.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3404 
Multiple PHP file inclusion vulnerabilities in ATutor 1.4.1 through 1.5.1-pl1 allow remote attackers to include arbitrary files via the section parameter followed by a null byte (%00) in (1) body_header.inc.php and (2) print.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3405 
ATutor 1.4.1 through 1.5.1-pl1 allows remote attackers to execute arbitrary PHP functions via a direct request to forum.inc.php with a modified addslashes parameter with either the (1) asc or (2) desc parameters set, possibly due to an eval injection vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3406 
Cross-site scripting (XSS) vulnerability in phpESP 1.7.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3407 
SQL injection vulnerability in phpESP 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3408 
SQL injection vulnerability in news.php in gCards version 1.43 allows remote attackers to execute arbitrary SQL commands via the limit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T11:00:00.000Z
CVE-2005-3409 
OpenVPN 2.x before 2.0.4, when running in TCP mode, allows remote attackers to cause a denial of service (segmentation fault) by forcing the accept function call to return an error status, which leads to a null dereference in an exception handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-02T00:00:00.000Z
CVE-2005-3411 
Cross-site scripting (XSS) vulnerability in post.asp in Snitz Forums 2000 3.4.05 allows remote attackers to inject arbitrary web script or HTML via the type parameter in a Topic method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T20:00:00.000Z
CVE-2005-3412 
Cross-site scripting (XSS) vulnerability in Elite Forum 1.0.0.0 allows remote attackers to inject arbitrary web script or HTML via a Post Reply to a topic, in which the reply contains a javascript: URL in an <img> tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T20:00:00.000Z
CVE-2005-3413 
Cross-site scripting (XSS) vulnerability in desktop.php in eyeOS 0.8.4 allows remote attackers to inject arbitrary web script or HTML via the motd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T20:00:00.000Z
CVE-2005-3414 
eyeOS 0.8.4 stores usrinfo.xml under the web document root with insufficient access control, which allows remote attackers to obtain user credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T20:00:00.000Z
CVE-2005-3415 
phpBB 2.0.17 and earlier allows remote attackers to bypass protection mechanisms that deregister global variables by setting both a GET/POST/COOKIE (GPC) variable and a GLOBALS[] variable with the same name, which causes phpBB to unset the GLOBALS[] variable but not the GPC variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T21:00:00.000Z
CVE-2005-3416 
phpBB 2.0.17 and earlier, when register_globals is enabled and the session_start function has not been called to handle a session, allows remote attackers to bypass security checks by setting the $_SESSION and $HTTP_SESSION_VARS variables to strings instead of arrays, which causes an array_merge function call to fail.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T21:00:00.000Z
CVE-2005-3417 
phpBB 2.0.17 and earlier, when the register_long_arrays directive is disabled, allows remote attackers to modify global variables and bypass security mechanisms because PHP does not define the associated HTTP_* variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T21:00:00.000Z
CVE-2005-3418 
Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.17 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) error_msg parameter to usercp_register.php, (2) forward_page parameter to login.php, and (3) list_cat parameter to search.php, which are not initialized as variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T21:00:00.000Z
CVE-2005-3419 
SQL injection vulnerability in usercp_register.php in phpBB 2.0.17 allows remote attackers to execute arbitrary SQL commands via the signature_bbcode_uid parameter, which is not properly initialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-01T21:00:00.000Z