rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-4910 
Unspecified vulnerability in netInvoicing before 2.7.3 has unknown impact and attack vectors, related to "security check soap".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4911 
JSMP3OGGWt.dll in JetCast Server 2.0.0.4308 allows remote attackers to cause a denial of service (daemon crash) via a long .mp3 URI to TCP port 8000.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4912 
Cross-site scripting (XSS) vulnerability in ips_kernel/class_ajax.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to inject arbitrary web script or HTML into user profile fields via unspecified vectors related to character sets other than iso-8859-1 or utf-8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4913 
ips_kernel/class_upload.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to upload arbitrary script files with crafted image filenames to uploads/, where they are saved with a .txt extension and are not executable.  NOTE: there are limited usage scenarios under which this would be a vulnerability, but it is being tracked by CVE since the vendor has stated it is security-relevant.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4914 
Unspecified vulnerability in the subscriptions manager in Invision Power Board (IPB or IP.Board) 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to (1) class_gw_2checkout.php, (2) class_gw_authorizenet.php, (3) class_gw_nochex.php, (4) class_gw_paypal.php, and (5) class_gw_safshop.php in sources/classes/paymentgateways/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4915 
The Intersil isl3893 extensions for Boa 0.93.15, as used on the FreeLan RO80211G-AP and other devices, do not prevent stack writes from entering memory locations used for string constants, which allows remote attackers to change the admin password stored in memory via a long username in an HTTP Basic Authentication request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4916 
Heap-based buffer overflow in the FileFind::FindFile method in (1) MFC42.dll, (2) MFC42u.dll, (3) MFC71.dll, and (4) MFC71u.dll in Microsoft Foundation Class (MFC) Library 8.0, as used by the ListFiles method in hpqutil.dll 2.0.0.138 in Hewlett-Packard (HP) All-in-One and Photo & Imaging Gallery 1.1 and probably other products, allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4917 
Cross-site scripting (XSS) vulnerability in tracking.php in PHP-Stats 0.1.9.2 allows remote attackers to inject arbitrary web script or HTML via the ip parameter in an online action, a different vector than CVE-2007-4334.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4918 
SQL injection vulnerability in classes/gelato.class.php in Gelato allows remote attackers to execute arbitrary SQL commands via the post parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4919 
Multiple SQL injection vulnerabilities in JBlog 1.0 allow (1) remote attackers to execute arbitrary SQL commands via the id parameter to index.php, and allow (2) remote authenticated administrators to execute arbitrary SQL commands via the id parameter to admin/modifpost.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4920 
SQL injection vulnerability in soporte_derecha_w.php in PHP Webquest 2.5 and earlier allows remote attackers to execute arbitrary SQL commands via the id_actividad parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4921 
PHP remote file inclusion vulnerability in _includes/settings.inc.php in Ajax File Browser 3 Beta allows remote attackers to execute arbitrary PHP code via a URL in the approot parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4922 
SQL injection vulnerability in play.php in the jeuxflash 1.0 module for KwsPHP allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a play ac action to index.php.  NOTE: some details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4923 
PHP remote file inclusion vulnerability in admin.joomlaradiov5.php in the Joomla Radio 5 (com_joomlaradiov5) component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-17T17:00:00.000Z
CVE-2007-4924 
The Open Phone Abstraction Library (opal), as used by (1) Ekiga before 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause a denial of service (crash) via an invalid Content-Length header field in Session Initiation Protocol (SIP) packets, which causes a \0 byte to be written to an "attacker-controlled address."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-10-08T21:00:00.000Z
CVE-2007-4925 
The ewirePC_Decrypt function in ewirepcfunctions.php in eWire Payment Client (ePC) 1.60 and 1.70 allows remote attackers to execute arbitrary commands via shell metacharacters in the paymentinfo parameter to simplePHPLinux/3payment_receive.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4926 
The AXIS 207W camera uses a base64-encoded cleartext username and password for authentication, which allows remote attackers to obtain sensitive information by sniffing the wireless network or by leveraging unspecified other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4927 
axis-cgi/buffer/command.cgi on the AXIS 207W camera allows remote authenticated users to cause a denial of service (reboot) via many requests with unique buffer names in the buffername parameter in a start action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4928 
The AXIS 207W camera stores a WEP or WPA key in cleartext in the configuration file, which might allow local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4929 
Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 207W camera allow remote attackers to inject arbitrary web script or HTML via the camNo parameter to incl/image_incl.shtml, and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4930 
Multiple cross-site request forgery (CSRF) vulnerabilities in the AXIS 207W camera allow remote attackers to perform certain actions as administrators via (1) axis-cgi/admin/restart.cgi, (2) the user and sgrp parameters to axis-cgi/admin/pwdgrp.cgi in an add action, or (3) the server parameter to admin/restartMessage.shtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4931 
HP System Management Homepage (SMH) for Windows, when used in conjunction with HP Version Control Agent or Version Control Repository Manager, leaves old OpenSSL software active after an OpenSSL update, which has unknown impact and attack vectors, probably related to previous vulnerabilities for OpenSSL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4932 
admin.php in Shop-Script FREE 2.0 and earlier sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to access the admin panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4933 
Direct static code injection vulnerability in includes/admin/sub/conf_appearence.php in Shop-Script FREE 2.0 and earlier allows remote attackers to inject arbitrary PHP code into cfg/appearence.inc.php via a save_appearence action in admin.php, as demonstrated with the (1) productscount, (2) colscount, and (3) darkcolor parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4934 
Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFL_FILE_ROOT parameter to (1) program_files/livedraft/livedraft.php or (2) program_files/livedraft/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4935 
Multiple PHP remote file inclusion vulnerabilities in phpFFL 1.24 allow remote attackers to execute arbitrary PHP code via a URL in the PHPFFL_FILE_ROOT parameter to (1) admin.php, (2) custom_pages.php, (3) draft.php, (4) faq.php, (5) leagues.php, (6) livedraft.php, (7) login.php, (8) my_team.php, (9) profile.php, (10) signup.php, (11) statistics.php, (12) transactions.php, (13) program_files/admin/custom_pages.php, or (14) program_files/common.php.  NOTE: the program_files/livedraft/admin.php and program_files/livedraft/livedraft.php vectors are covered by CVE-2007-4934.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T18:00:00.000Z
CVE-2007-4936 
Unspecified vulnerability in Office Efficiencies SafeSquid 4.1.x has unknown impact and attack vectors, related to a "serious security flaw," possibly specific to Linux.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4937 
CS Guestbook stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the admin name and MD5 password hash via a direct request for base/usr/0.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4938 
Heap-based buffer overflow in libmpdemux/aviheader.c in MPlayer 1.0rc1 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values, and a certain wLongsPerEntry value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4939 
Heap-based buffer overflow in mplayerc.exe in Media Player Classic (MPC) 6.4.9.0 and earlier, as used standalone and in mympc (aka CD-Storm) 1.0.0.1, StormPlayer 1.0.4, and possibly other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with an "indx truck size" of 0xffffffff, and certain wLongsPerEntry and nEntriesInuse values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4940 
Multiple integer overflows in Media Player Classic (MPC) 6.4.9.0 and earlier, as used standalone and in mympc (aka CD-Storm) 1.0.0.1, StormPlayer 1.0.4, and possibly other products, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4941 
KMPlayer 2.9.3.1210 and earlier allows remote attackers to cause a denial of service (CPU consumption) via a .avi file with certain large "indx truck size" and nEntriesInuse values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4942 
PHP remote file inclusion vulnerability in modules/Discipline/StudentFieldBreakdown.php in Focus/SIS 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the FocusPath parameter, a different vector than CVE-2007-4806.  NOTE: the provenance of this information is unknown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4943 
Multiple buffer overflows in a certain ActiveX control in sparser.dll in Baofeng Storm 2.8 and earlier allow remote attackers to execute arbitrary code via malformed input in an unknown set of arguments or property values, a different DLL than CVE-2007-4816.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4944 
The canvas.createPattern function in Opera 9.x before 9.22 for Linux, FreeBSD, and Solaris does not clear memory before using it to process a new pattern, which allows remote attackers to obtain sensitive information (memory contents) via JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4945 
Multiple cross-site scripting (XSS) vulnerabilities in LetterGrade allow remote attackers to inject arbitrary web script or HTML via (1) a student's email address, (2) the year parameter to genbrws/Student/cal_month.php3, and other unspecified vectors related to the calendar.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4946 
LetterGrade allows remote attackers to obtain sensitive information (installation path or account existence) via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T19:00:00.000Z
CVE-2007-4947 
Multiple PHP remote file inclusion vulnerabilities in myphpPagetool 0.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the ptinclude parameter to (1) help1.php, (2) help2.php, (3) help3.php, (4) help4.php, (5) help5.php, (6) help6.php, (7) help7.php, (7) help8.php, (8) help9.php, or (10) index.php in doc/admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4948 
Multiple PHP remote file inclusion vulnerabilities in Webmedia Explorer (webmex) 3.2.2 allow remote attackers to execute arbitrary PHP code via (1) a URL in the path_include parameter to includes/rss.class.php, (2) a URL in the path_template parameter to (a) templates/main.tpl.php or (b) templates/folder_messages_link_message_name.tpl.php, or (4) a URL in the path_templates parameter to templates/sidebar.tpl.php.  NOTE: the vulnerability is present only when the administrator does not follow installation instructions about the requirement for .htaccess support. NOTE: the includes/core.lib.php vector is already covered by CVE-2006-5252.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4949 
Multiple PHP remote file inclusion vulnerabilities in php(Reactor) 1.2.7pl1 allow remote attackers to execute arbitrary PHP code via a URL in the pathtohomedir parameter to (1) ekilat.com-int.tpl.php, (2) phpreactor.org-top.tpl.php, or (3) ekilat.com-top.tpl.php in examples/.  NOTE: this issue has been disputed by CVE, since the vulnerability is present only when the product is incorrectly installed by placing examples/ under the web root
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4950 
PHP remote file inclusion vulnerability in form/db_form/employee.php in PHPortal 0.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter.  NOTE: this issue is disputed by CVE, since DOCUMENT_ROOT cannot be modified by an attacker
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4951 
PHP remote file inclusion vulnerability in sample.php in YaPiG 0.95b allows remote attackers to execute arbitrary PHP code via a URL in the YAPIG_PATH parameter.  NOTE: this issue has been disputed by CVE, since YAPIG_PATH is defined before use
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4952 
SQL injection vulnerability in article.php in OmniStar Article Manager allows remote attackers to execute arbitrary SQL commands via the page_id parameter in a favorite op action, a different vector than CVE-2006-5917.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4953 
SQL injection vulnerability in index.php in SimpCMS allows remote attackers to execute arbitrary SQL commands via the keyword parameter in a search site action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4954 
PHP remote file inclusion vulnerability in admin.joom12pic.php in the joom12Pic (com_joom12pic) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4955 
PHP remote file inclusion vulnerability in admin.joomlaflashfun.php in the Flash Fun! (com_joomlaflashfun) 1.0 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_live_site parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4956 
Multiple SQL injection vulnerabilities in KwsPHP 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the pseudo parameter to login.php, (2) the id parameter to index.php in a carnet editer action in the Member_Space (espace_membre) module, or (3) the typenav parameter to index.php in a browser aff action in the stats module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4957 
Multiple directory traversal vulnerabilities in download.php in Chupix CMS 0.2.3 allow remote attackers to read or overwrite arbitrary files via a .. (dot dot) in the (1) fichier or (2) repertoire parameter, or create arbitrary directories via a .. (dot dot) in the (3) repertoire parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T20:00:00.000Z
CVE-2007-4958 
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) 1.6.3.4 allow remote attackers to inject arbitrary web script or HTML via the URI for (1) index.php, (2) i_frames/i_login.php, and (3) i_frames/i_top_tags.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4959 
Cross-site scripting (XSS) vulnerability in catalog_products_with_images.php in osCMax 2.0.0-RC3-0-1 allows remote attackers to inject arbitrary web script or HTML via the URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4960 
Argument injection vulnerability in the Linden Lab Second Life secondlife:// protocol handler, as used in Internet Explorer and possibly Firefox, allows remote attackers to obtain sensitive information via a '" ' (double-quote space) sequence followed by the -autologin and -loginuri arguments, which cause the handler to post login credentials and software installation details to an arbitrary URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4961 
The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4962 
Directory traversal vulnerability in WinImage 8.10 and earlier allows user-assisted remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a filename within a (1) .IMG or (2) .ISO file. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4963 
Visual truncation vulnerability in WinImage 8.10 and earlier allows remote attackers to spoof a destination filename via a long sequence of space characters in a filename within a (1) .IMG or (2) .ISO file. NOTE: this can be leveraged with a separate directory traversal vulnerability to trick a careful user into overwriting arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4964 
WinImage 8.10 and earlier allows remote attackers to cause a denial of service (infinite loop) via an invalid BPB_BytsPerSec field in the header of a .IMG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4965 
Multiple integer overflows in the imageop module in Python 2.5.1 and earlier allow context-dependent attackers to cause a denial of service (application crash) and possibly obtain sensitive information (memory contents) via crafted arguments to (1) the tovideo method, and unspecified other vectors related to (2) imageop.c, (3) rbgimgmodule.c, and other files, which trigger heap-based buffer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z
CVE-2007-4966 
SQL injection vulnerability in www/people/editprofile.php in GForge 4.6b2 and earlier allows remote attackers to execute arbitrary SQL commands via the skill_delete[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-09-18T22:00:00.000Z