rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-5405 
Multiple buffer overflows in kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, allow remote attackers to execute arbitrary code via a .ag file with (1) a long ENCODING attribute in a *BEGIN tag, (2) a long token, or (3) the initial *BEGIN tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-10T18:00:00.000Z
CVE-2007-5406 
kpagrdr.dll 2.0.0.2 and 10.3.0.0 in the Applix Presents reader in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes, Symantec Mail Security, and activePDF DocConverter, does not properly parse long tokens, which allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted .ag file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-04-10T18:00:00.000Z
CVE-2007-5407 
Multiple PHP remote file inclusion vulnerabilities in the JContentSubscription (com_jcs) 1.5.8 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) jcs.function.php; (2) add.php, (3) history.php, and (4) register.php, in view/; and (5) list.sub.html.php, (6) list.user.sub.html.php, and (7) reports.html.php in views/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T18:00:00.000Z
CVE-2007-5408 
SQL injection vulnerability in category.php in cpDynaLinks 1.02 allows remote attackers to execute arbitrary SQL commands via the category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T18:00:00.000Z
CVE-2007-5409 
PHP remote file inclusion vulnerability in admin/nuseo_admin_d.php in NuSEO PHP Enterprise 1.6 (NuSEO.PHP), when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the nuseo_dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T18:00:00.000Z
CVE-2007-5410 
PHP remote file inclusion vulnerability in admin.wmtrssreader.php in the webmaster-tips.net Flash RSS Reader (com_wmtrssreader) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T18:00:00.000Z
CVE-2007-5411 
Cross-site scripting (XSS) vulnerability in the Linksys SPA941 VoIP Phone with firmware 5.1.8 allows remote attackers to inject arbitrary web script or HTML via the From header in a SIP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T18:00:00.000Z
CVE-2007-5412 
Multiple PHP remote file inclusion vulnerabilities in the Quoc-Huy MP3 Allopass (com_mp3_allopass) 1.0 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter to (1) allopass.php and (2) allopass-error.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T18:00:00.000Z
CVE-2007-5413 
httpd.tkd in Radia Integration Server in Hewlett-Packard (HP) OpenView Configuration Management (CM) Infrastructure 4.0 through 4.2i and Client Configuration Manager (CCM) 2.0 allows remote attackers to read arbitrary files via URLs containing tilde (~) references to home directories, as demonstrated by ~root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-29T22:00:00.000Z
CVE-2007-5414 
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses single quote characters to delimit a literal string within an XSS sequence, a related issue to CVE-2007-5415.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5415 
Cross-site scripting (XSS) vulnerability in Mozilla Firefox 2.0, when UTF-7 document content is rendered directly in UTF-7, allows remote attackers to inject arbitrary web script or HTML via a gopher URI that uses '/' (slash) characters to delimit a literal string within an XSS sequence, a related issue to CVE-2007-5414.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5416 
Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter.  NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Drupal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5417 
Directory traversal vulnerability in index.php in boastMachine (aka bMachine) 2.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5418 
Multiple PHP remote file inclusion vulnerabilities in CARE2X 2G 2.2 allow remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) en_copyrite.php, (2) vi_copyrite.php, and (3) ar_copyrite.php in language/ directories; (4) class_access.php, (5) class_department.php, (6) class_config.php, (7) class_image.php, (8) class_ward.php, and (9) class_product.php in include/care_api_classes/; (10) gui/smarty_template/smarty_care.class.php; and possibly other components, different vectors than CVE-2007-1458.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5419 
The 3Com 3CRWER100-75 router with 1.2.10ww software, when enabling an optional virtual server, configures this server to accept all source IP addresses on the external (Internet) interface unless the user selects other options, which might expose the router to unintended incoming traffic from remote attackers, as demonstrated by setting up a virtual server on port 80, which allows remote attackers to access the web management interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5420 
The 3Com 3CRWER100-75 router with 1.2.10ww software, when remote management is disabled but a web server has been configured, serves a web page to external clients, which might allow remote attackers to obtain information about the router's existence and product details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5422 
Unspecified vulnerability in "Solaris Auditing" in the Basic Security Module (BSM) in Sun Solaris 10, when configured for auditing of networking (nt) events, allows local users to cause a denial of service (panic) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T21:00:00.000Z
CVE-2007-5423 
tiki-graph_formula.php in TikiWiki 1.9.8 allows remote attackers to execute arbitrary code via PHP sequences in the f array parameter, which are processed by create_function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5424 
The disable_functions feature in PHP 4 and 5 allows attackers to bypass intended restrictions by using an alias, as demonstrated by using ini_alter when ini_set is disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5425 
SQL injection vulnerability in admin/index.php in Interspire ActiveKB 1.5 allows remote attackers to execute arbitrary SQL commands via the questId parameter in a hideQuestion ToDo action.  NOTE: the catId vector is already covered by CVE-2007-5131.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5426 
Multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by (1) ActiveKB/ and (2) default/categories/ActiveKB/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5427 
Cross-site scripting (XSS) vulnerability in the com_search component in Joomla! 1.0.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchword parameter.  NOTE: this might be related to CVE-2007-4189.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5428 
Cross-site scripting (XSS) vulnerability in UMI CMS allows remote attackers to inject arbitrary web script or HTML via the search_string parameter to the default URI in search_do/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5429 
Cross-site scripting (XSS) vulnerability in index.php in Nucleus 3.01 allows remote attackers to inject arbitrary web script or HTML via the archive parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5430 
Multiple SQL injection vulnerabilities in Stride 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the p parameter to main.php in the Content Management System, (2) the id parameter in a sto cmd action to shop.php in the Merchant subsystem, or the (3) course or (4) provider parameter to detail.php in the Courses subsystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5431 
include/imageupload.js in the MyFTPUploader module in Stride 1.0 contains sensitive information including FTP login credentials, which might allow remote attackers to gain unauthorized access to the FTP server being used by the module by viewing the source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5432 
Stride 1.0 has a default administrator username of "scott" with the password "running", which allows remote attackers to obtain administrative access through login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5433 
Multiple cross-site scripting (XSS) vulnerabilities in index.cgi in Site-Up 2.64 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) search or (2) search mask field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5434 
Cross-site scripting (XSS) vulnerability in PRO-search 0.17.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-12T23:00:00.000Z
CVE-2007-5435 
Unspecified vulnerability in CA ERwin Process Modeler (formerly AllFusion Process Modeler) 7.2 might allow user-assisted remote attackers to cause a denial of service via a crafted Data Standards File (Datatype Standards File).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T01:00:00.000Z
CVE-2007-5436 
Buffer overflow in a certain ActiveX control in ScanObjectBrowser.DLL in G DATA Antivirus 2007 might allow remote attackers to execute arbitrary code via unspecified parameters to the SelectPath function. NOTE: this issue might not cross privilege boundaries in most environments, since it is not marked as safe for scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T01:00:00.000Z
CVE-2007-5437 
The web console in CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 allows remote attackers to redirect users to arbitrary web sites via a crafted HTTP URL on port 6689.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T01:00:00.000Z
CVE-2007-5438 
Unspecified vulnerability in a certain ActiveX control in Reconfig.DLL in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 might allow local users to cause a denial of service to the Virtual Disk Mount Service (vmount2.exe), related to the ConnectPopulatedDiskEx function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T01:00:00.000Z
CVE-2007-5439 
CA (formerly Computer Associates) eTrust ITM (Threat Manager) 8.1 stores sensitive user information in log files with predictable names, which allows remote attackers to obtain this information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-13T01:00:00.000Z
CVE-2007-5440 
Multiple PHP remote file inclusion vulnerabilities in CRS Manager allow remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter to (1) index.php or (2) login.php.  NOTE: this issue is disputed by CVE, since DOCUMENT_ROOT cannot be modified by an attacker
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T17:00:00.000Z
CVE-2007-5441 
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users in some situations, which allows remote authenticated users to perform some administrative actions, as demonstrated by (1) adding a user via a direct request to admin/adduser.php and (2) reading the admin log via an "admin/adminlog.php?page=1" request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5442 
CMS Made Simple 1.1.3.1 does not check the permissions assigned to users who attempt uploads, which allows remote authenticated users to upload unspecified files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5443 
Multiple cross-site scripting (XSS) vulnerabilities in CMS Made Simple 1.1.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) the anchor tag and (2) listtags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5444 
CMS Made Simple 1.1.3.1 allows remote attackers to obtain the full path via a direct request for unspecified files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5445 
Buffer overflow in the DB Software Laboratory VImpX (VImpAX1) ActiveX control in VImpX.ocx 4.7.3.0 allows remote attackers to execute arbitrary code via a long RejectedRecordsFile parameter, a different vector than CVE-2007-2667.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5446 
Absolute path traversal vulnerability in a certain ActiveX control in PBEmail7Ax.dll in PBEmail 7 ActiveX Edition allows remote attackers to create or overwrite arbitrary files via a full pathname in the XmlFilePath argument to the SaveSenderToXml method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5447 
ioncube_loader_win_5.2.dll in the ionCube Loader 6.5 extension for PHP 5.2.4 does not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by reading arbitrary files via the ioncube_read_file function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5448 
Madwifi 0.9.3.2 and earlier allows remote attackers to cause a denial of service (panic) via a beacon frame with a large length value in the extended supported rates (xrates) element, which triggers an assertion error, related to net80211/ieee80211_scan_ap.c and net80211/ieee80211_scan_sta.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5449 
SQL injection vulnerability in searchresult.php in Softbiz Recipes Portal Script allows remote attackers to execute arbitrary SQL commands via the sbcat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5450 
Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote attackers to cause a denial of service (application crash), and enable filesystem browsing by the local user, via a certain TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5451 
PHP remote file inclusion vulnerability in admin.color.php in the com_colorlab (aka com_color) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5452 
Multiple SQL injection vulnerabilities in php-stats.recjs.php in Php-Stats 0.1.9.2 allow remote attackers to execute arbitrary SQL commands via the (1) ip or (2) t parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5453 
Multiple eval injection vulnerabilities in Php-Stats 0.1.9.2 allow remote authenticated administrators to execute arbitrary code by writing PHP sequences to the php-stats-options record in the _options table, which is used in an eval function call by (1) admin.php, (2) click.php, (3) download.php, and unspecified other files, as demonstrated by modifying _options through a backup restore action in admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5454 
Directory traversal vulnerability in index.php in PHP File Sharing System 1.5.1 allows remote attackers to list or create arbitrary directories, or delete arbitrary files, as demonstrated by listing directories via a .. (dot dot) in the cam parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5455 
Cross-site scripting (XSS) vulnerability in wxis.exe in WWWISIS 7.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a call to the iah/iah.xis IsisScript code, possibly involving the lang or exprSearch parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5456 
Microsoft Internet Explorer 7 and earlier allows remote attackers to bypass the "File Download - Security Warning" dialog box and download arbitrary .exe files by placing a '?' (question mark) followed by a non-.exe filename after the .exe filename, as demonstrated by (1) .txt, (2) .cda, (3) .log, (4) .dif, (5) .sol, (6) .htt, (7) .itpc, (8) .itms, (9) .dvr-ms, (10) .dib, (11) .asf, (12) .tif, and unspecified other extensions, a different issue than CVE-2004-1331.  NOTE: this issue might not cross privilege boundaries, although it does bypass an intended protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T18:00:00.000Z
CVE-2007-5457 
Multiple PHP remote file inclusion vulnerabilities in Michael Dempfle Joomla Flash Uploader (com_jfu or com_joomla_flash_uploader) 2.5.1 component for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) install.joomla_flash_uploader.php and (2) uninstall.joomla_flash_uploader.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T19:00:00.000Z
CVE-2007-5458 
SQL injection vulnerability in index.php in the newsletter module 1.0 for KwsPHP, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the newsletter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T19:00:00.000Z
CVE-2007-5459 
Cross-site scripting (XSS) vulnerability in the sidebar HTML page in the MouseoverDictionary before 0.6.2 extension for Mozilla Firefox allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-14T19:00:00.000Z
CVE-2007-5460 
Microsoft ActiveSync 4.1, as used in Windows Mobile 5.0, uses weak encryption (XOR obfuscation with a fixed key) when sending the user's PIN/Password over the USB connection from the host to the device, which might make it easier for attackers to decode a PIN/Password obtained by (1) sniffing or (2) spoofing the docking process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-15T22:00:00.000Z
CVE-2007-5461 
Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-15T18:00:00.000Z
CVE-2007-5462 
Unspecified vulnerability in the Sun Solaris RPC services library (librpcsvc) on Solaris 8 through 10 allows remote attackers to cause a denial of service (mountd crash) via unspecified packets to a server that exports many filesystems, and allows local users to cause a denial of service (automountd crash) via unspecified requests to mount filesystems from a server that exports many filesystems.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-15T22:00:00.000Z
CVE-2007-5463 
ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364.  NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-15T22:00:00.000Z
CVE-2007-5464 
Stack-based buffer overflow in Live for Speed 0.5X10 and earlier allows remote authenticated users to cause a denial of service (client crash) and possibly execute arbitrary code via a long skin name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-15T22:00:00.000Z
CVE-2007-5465 
Directory traversal vulnerability in doop CMS 1.3.7 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter to an unspecified component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-15T23:00:00.000Z