rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-6063 
Stack-based buffer overflow in Un4seen XMPlay 3.3.0.5 and earlier allows remote attackers to execute arbitrary code via a M3U file containing a long (1) FileName, and cause a crash via a long (2) DisplayName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6064 
Multiple buffer overflows in the Message Parsing Interpreter (MPI) in Fuzzball MUCK before 6.07 allow remote attackers to execute arbitrary code via crafted messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6065 
PHP remote file inclusion vulnerability in includes/mx_common.php in the CalSnails Module for MxBB Portal 1.06 allows remote attackers to execute arbitrary PHP code via a URL in the module_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6066 
Multiple SQL injection vulnerabilities in Dragon Calendar / Events Listing 2.x allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter to (a) admin_login.asp, the (3) ID parameter to (b) event_searchdetail.asp, or the (4) VenueID parameter to (c) venue_detail.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6067 
Multiple SQL injection vulnerabilities in 20/20 DataShed (aka Real Estate Listing System) allow remote attackers to execute arbitrary SQL commands via the (1) itemID parameter to (a) f-email.asp, or the (2) peopleID and (2) sort_order parameters to (b) listings.asp, different vectors than CVE-2006-5955.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6068 
Directory traversal vulnerability in the cached_album function in functions.php for mAlbum 0.3 and earlier allows remote attackers to list filenames of arbitrary images via a .. (dot dot) in the gal parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6069 
index.php in mAlbum 0.3 and earlier allows remote attackers to obtain the installation path via an invalid gal parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6070 
SQL injection vulnerability in module/account/register/register.asp in ASP Nuke 0.80 and earlier allows remote attackers to execute arbitrary SQL commands via the StateCode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-22T02:00:00.000Z
CVE-2006-6071 
TWiki 4.0.5 and earlier, when running under Apache 1.3 using ApacheLogin with sessions and "ErrorDocument 401" redirects to a valid wiki topic, does not properly handle failed login attempts, which allows remote attackers to read arbitrary content by cancelling out of a failed authentication with a valid username and invalid password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-02T02:00:00.000Z
CVE-2006-6072 
SQL injection vulnerability in bpg/publications_list.asp in BPG-InfoTech Easy Publisher and Smart Publisher//Pro 2.7.7 allows remote attackers to execute arbitrary SQL commands via the vjob parameter.  NOTE: the provenance of this information is unknown; the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6073 
Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via the (1) ProductID parameter in productdetail.asp or the (2) categoryid parameter in products.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6074 
Multiple SQL injection vulnerabilities in Enthrallweb eShopping Cart allow remote attackers to execute arbitrary SQL commands via (1) the ProductID parameter in (a) reviews.asp, or the (2) cat_id or (3) sub_id parameter in (b) subProducts.asp.  NOTE: the productdetail.asp vector is already covered by another identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6075 
Cross-site scripting (XSS) vulnerability in addpost1.asp in BaalAsp forum allows remote attackers to inject arbitrary web script or HTML via the name parameter.  NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6076 
Buffer overflow in the Tape Engine (tapeeng.exe) in CA (formerly Computer Associates) BrightStor ARCserve Backup 11.5 and earlier allows remote attackers to execute arbitrary code via certain RPC requests to TCP port 6502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6077 
The (1) Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the (2) Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a password, which allows remote attackers to obtain passwords via a password INPUT element on a different web page located on the web site intended for this password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6078 
PHP remote file inclusion vulnerability in common.inc.php in a-ConMan 3.2 beta allows remote attackers to execute arbitrary PHP code via a URL in the cm_basedir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6079 
Multiple PHP remote file inclusion vulnerabilities in LoudMouth 2.4 allow remote attackers to execute arbitrary PHP code via a URL in the mainframe parameter to (1) admin.loudmouth.php or (2) toolbar.loudmouth.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6080 
Multiple SQL injection vulnerabilities in categories.asp in gNews Publisher allow remote attackers to execute arbitrary SQL commands via the (1) catID or (2) editorID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6081 
PHP remote file inclusion vulnerability in Smarty_Compiler.class.php in Telaen 1.1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the plugin_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T17:00:00.000Z
CVE-2006-6082 
Multiple cross-site scripting (XSS) vulnerabilities in CreaScripts Creadirectory allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to addlisting.asp or the (2) search parameter to search.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6083 
SQL injection vulnerability in search.asp in CreaScripts Creadirectory allows remote attackers to execute arbitrary SQL commands via the category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6084 
Directory traversal vulnerability in abitwhizzy.php in aBitWhizzy allows remote attackers to read arbitrary files via a .. (dot dot) in the f parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6085 
Kile before 1.9.3 does not assign a backup file the same permissions as the original file, which might allow local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6086 
PHP remote file inclusion vulnerability in src/ark_inc.php in e-Ark 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the cfg_pear_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6087 
Cross-site scripting (XSS) vulnerability in weblog.php in my little weblog allows remote attackers to inject arbitrary web script or HTML via the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6088 
Multiple cross-site scripting (XSS) vulnerabilities in BlueCollar i-Gallery 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) n or (2) d parameter in igallery.asp, or (3) an unspecified parameter related to search, possibly the Search Gallery field, or the myquery parameter, in search.asp.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6089 
Multiple cross-site scripting (XSS) vulnerabilities in addpost1.asp in BaalAsp forum allow remote attackers to inject arbitrary web script or HTML via the (1) title (Subject), (2) groupname (Group Name), or (3) detail (Message) field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6090 
Multiple SQL injection vulnerabilities in BaalAsp forum allow remote attackers to execute arbitrary SQL commands via the (1) password parameter to (a) adminlogin.asp, the (2) name or (3) password parameter to (b) userlogin.asp, or the (3) search parameter to search.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6091 
Cross-site scripting (XSS) vulnerability in Grim Pirate GrimBB before 2006_11_21 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6092 
Multiple SQL injection vulnerabilities in vehiclelistings.asp in 20/20 Auto Gallery allow remote attackers to execute arbitrary SQL commands via the (1) vehicleID, (2) categoryID_list, (3) sale_type, (4) stock_number, (5) manufacturer, (6) model, (7) vehicleID, (8) year, (9) vin, and (10) listing_price parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6093 
Multiple PHP remote file inclusion vulnerabilities in adminprint.php in PicturesPro Photo Cart 3.9 allow remote attackers to execute arbitrary PHP code via a URL in the (1) admin_folder and (2) path parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6094 
Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) catID parameter to activeNews_categories.asp, the (2) articleID parameter to activeNews_comments.asp, or the (3) query parameter to activenews_search.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6095 
Multiple SQL injection vulnerabilities in ActiveNews Manager allow remote attackers to execute arbitrary SQL commands via the (1) articleID parameter to activenews_view.asp or the (2) page parameter to default.asp.  NOTE: the activeNews_categories.asp and activeNews_comments.asp vectors are already covered by CVE-2006-6094.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6096 
Cross-site scripting (XSS) vulnerability in activenews_search.asp in ActiveNews Manager allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6097 
GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-24T18:00:00.000Z
CVE-2006-6101 
Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of glyph management data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2006-6102 
Integer overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2006-6103 
Integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-01-09T23:00:00.000Z
CVE-2006-6104 
The System.Web class in the XSP for ASP.NET server 1.1 through 2.0 in Mono does not properly verify local pathnames, which allows remote attackers to (1) read source code by appending a space (%20) to a URI, and (2) read credentials via a request for Web.Config%20.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-21T19:00:00.000Z
CVE-2006-6105 
Format string vulnerability in the host chooser window (gdmchooser) in GNOME Foundation Display Manager (gdm) allows local users to execute arbitrary code via format string specifiers in a hostname, which are used in an error dialog.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-15T02:00:00.000Z
CVE-2006-6106 
Multiple buffer overflows in the cmtp_recv_interopmsg function in the Bluetooth driver (net/bluetooth/cmtp/capi.c) in the Linux kernel 2.4.22 up to 2.4.33.4 and 2.6.2 before 2.6.18.6, and 2.6.19.x, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via CAPI messages with a large value for the length of the (1) manu (manufacturer) or (2) serial (serial number) field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-19T19:00:00.000Z
CVE-2006-6107 
Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-14T00:00:00.000Z
CVE-2006-6108 
Cross-site scripting (XSS) vulnerability in EC-CUBE before 1.0.1a-beta allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6109 
Multiple SQL injection vulnerabilities in CandyPress Store 3.5.2.14 allow remote attackers to execute arbitrary SQL commands via the (1) policy parameter in openPolicy.asp or the (2) brand parameter in prodList.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6110 
Multiple SQL injection vulnerabilities in an unspecified BPG-InfoTech Content Management System product allow remote attackers to execute arbitrary SQL commands via the (1) vjob parameter in publications_list.asp or (2) InfoID parameter in publication_view.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6111 
Multiple SQL injection vulnerabilities in Alan Ward A-Cart Pro 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) productid parameter in product.asp or (2) search parameter in search.asp.  NOTE: the category.asp vector is already covered by CVE-2004-1873.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6112 
LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under (1) class/ and (2) plugins/, which allows remote attackers to obtain the installation path via a direct request to any of the scripts, as demonstrated by (a) bayesianfilter.class.php and (b) bootstrap.php, which leaks the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-06T22:00:00.000Z
CVE-2006-6113 
Monkey Boards 0.3.5 allows remote attackers to obtain sensitive information via direct requests to (1) include/admin_auth.inc.php and (2) include/engine/class.compiler.php, which reveals the full path in an error message.  NOTE: this issue is only an exposure if the administrator has changed the default script path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T23:00:00.000Z
CVE-2006-6115 
SQL injection vulnerability in index.asp in fipsCMS 4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the fid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6116 
SQL injection vulnerability in default2.asp in fipsForum 2.6 and earlier allows remote attackers to execute arbitrary SQL commands via the kat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6117 
SQL injection vulnerability in index1.asp in fipsGallery 1.5 and earlier allows remote attackers to execute arbitrary SQL commands via the which parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6118 
Cross-site scripting (XSS) vulnerability in thumbs.php in mmgallery 1.55 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6119 
mmgallery 1.55 allows remote attackers to obtain sensitive information via a direct request for thumbs.php, which reveals the installation path in various error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T22:00:00.000Z
CVE-2006-6120 
Integer overflow in the KPresenter import filter for Microsoft PowerPoint files (filters/olefilters/lib/klaola.cc) in KOffice before 1.6.1 allows user-assisted remote attackers to execute arbitrary code via a crafted PPT file, which results in a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-12-03T17:00:00.000Z
CVE-2006-6121 
Acer Notebook LunchApp.APlunch ActiveX control allows remote attackers to execute arbitrary commands by calling the Run method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T23:00:00.000Z
CVE-2006-6122 
Multiple buffer overflows in TIN before 1.8.2 have unspecified impact and attack vectors, a different vulnerability than CVE-2006-0804.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T23:00:00.000Z
CVE-2006-6123 
Coppermine Photo Gallery (CPG) 1.4.8 stable, with register_globals enabled, allows remote attackers to bypass XSS protection and set arbitrary variables via a query string that causes the variable to be defined in global space, with separate _GET, _REQUEST, or other critical parameters, which are unset by the protection scheme and prevent the original variable from being detected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T23:00:00.000Z
CVE-2006-6124 
Cross-site scripting (XSS) vulnerability in SeleniumServer Web Server 1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-26T23:00:00.000Z
CVE-2006-6125 
Heap-based buffer overflow in the wireless driver (WG311ND5.SYS) 2.3.1.10 for NetGear WG311v1 wireless adapter allows remote attackers to execute arbitrary code via an 802.11 management frame with a long SSID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-27T00:00:00.000Z
CVE-2006-6126 
Apple Mac OS X allows local users to cause a denial of service (memory corruption) via a crafted Mach-O binary with a malformed load_command data structure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-27T00:00:00.000Z
CVE-2006-6127 
Apple Mac OS X kernel allows local users to cause a denial of service via a process that uses kevent to register a queue and an event, then fork a child process that uses kevent to register an event for the same queue as the parent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-27T00:00:00.000Z
CVE-2006-6128 
The ReiserFS functionality in Linux kernel 2.6.18, and possibly other versions, allows local users to cause a denial of service via a malformed ReiserFS file system that triggers memory corruption when a sync is performed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-27T00:00:00.000Z
CVE-2006-6129 
Integer overflow in the fatfile_getarch2 in Apple Mac OS X allows local users to cause a denial of service and possibly execute arbitrary code via a crafted Mach-O Universal program that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-27T00:00:00.000Z
CVE-2006-6130 
Apple Mac OS X AppleTalk allows local users to cause a denial of service (kernel panic) by calling the AIOCREGLOCALZN ioctl command with a crafted data structure on an AppleTalk socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T01:00:00.000Z
CVE-2006-6131 
Untrusted search path vulnerability in (1) WSAdminServer and (2) WSWebServer in Kerio WebSTAR (4D WebSTAR Server Suite) 5.4.2 and earlier allows local users with webstar privileges to gain root privileges via a malicious libucache.dylib helper library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T01:00:00.000Z
CVE-2006-6132 
Multiple SQL injection vulnerabilities in Link Exchange Lite allow remote attackers to execute arbitrary SQL commands via (1) the search engine field to search.asp and (2) psearch parameter to linkslist.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-11-28T01:00:00.000Z