rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-7155 
Novell BorderManager 3.8 SP4 generates the same ISAKMP cookies for the same source IP and port number during the same day, which allows remote attackers to conduct denial of service and replay attacks. NOTE: this issue might be related to CVE-2006-5286.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T20:00:00.000Z
CVE-2006-7156 
PHP remote file inclusion vulnerability in addon_keywords.php in Keyword Replacer (keyword_replacer) 1.0 and earlier, a module for miniBB, allows remote attackers to execute arbitrary PHP code via a URL in the pathToFiles parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T20:00:00.000Z
CVE-2006-7157 
Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to cause a denial of service (crash) via a KML or KMZ file with a long href element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T20:00:00.000Z
CVE-2006-7158 
Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATION_MSG parameter.  NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T20:00:00.000Z
CVE-2006-7159 
Directory traversal vulnerability in include/prune_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows remote attackers to delete arbitrary files via ".." sequences in the TORRENTSDIR parameter in a prune action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T20:00:00.000Z
CVE-2006-7160 
The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions, which allows local users to cause a denial of service (crash) via invalid arguments to the (1) NtAssignProcessToJobObject,, (2) NtCreateKey, (3) NtCreateThread, (4) NtDeleteFile, (5) NtLoadDriver, (6) NtOpenProcess, (7) NtProtectVirtualMemory, (8) NtReplaceKey, (9) NtTerminateProcess, (10) NtTerminateThread, (11) NtUnloadDriver, and (12) NtWriteVirtualMemory functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T20:00:00.000Z
CVE-2006-7161 
SQL injection vulnerability in giris_yap.asp in Hazir Site 2.0 allows remote attackers to bypass authentication via the (1) k_a class or (2) sifre parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T20:00:00.000Z
CVE-2006-7162 
PuTTY 0.59 and earlier uses weak file permissions for (1) ppk files containing private keys generated by puttygen and (2) session logs created by putty, which allows local users to gain sensitive information by reading these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-07T21:00:00.000Z
CVE-2006-7163 
DreameeSoft Password Master 1.0 stores the database in an unencrypted format when the master password is set, which allows attackers with physical access to read the database contents via an unspecified authentication bypass.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-10T00:00:00.000Z
CVE-2006-7164 
SimpleFileServlet in IBM WebSphere Application Server 5.0.1 through 5.0.2.7 on Linux and UNIX does not block certain invalid URIs and does not issue a security challenge, which allows remote attackers to read secure files and obtain sensitive information via certain requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7165 
IBM WebSphere Application Server (WAS) 5.0 through 5.1.1.0 allows remote attackers to obtain JSP source code and other sensitive information via certain "special URIs."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7166 
IBM WebSphere Application Server (WAS) 5.1.1.9 and earlier allows remote attackers to obtain JSP source code and other sensitive information via "a specific JSP URL."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7167 
Unspecified vulnerability in ProRat Server 1.9 Fix2 allows remote attackers to bypass the authentication mechanism for remote login via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7168 
PHP remote file inclusion vulnerability in includes/not_mem.php in the Add Name module for PHP allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7169 
PHP remote file inclusion vulnerability in includes/header_simple.php in Ultimate PHP Board (UPB) 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _CONFIG[skin_dir] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7170 
Multiple SQL injection vulnerabilities in Koan Software Mega Mall allow remote attackers to execute arbitrary SQL commands via the (1) t, (2) productId, (3) sk, (4) x, or (5) so parameter to (a) product_review.php; or the (6) orderNo parameter to (b) order-track.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7171 
product_review.php in Koan Software Mega Mall allows remote attackers to obtain the installation path via a request with an empty value of the x[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T10:00:00.000Z
CVE-2006-7172 
Multiple SQL injection vulnerabilities in php-stats.recphp.php in PHP-Stats 0.1.9.1b and earlier allow remote attackers to execute arbitrary code via a leading dotted-quad IP address string in the (1) PC-REMOTE-ADDR HTTP header, which is inserted into $_SERVER['HTTP_PC_REMOTE_ADDR'], or (2) ip parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T22:00:00.000Z
CVE-2006-7173 
Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted option_new[report_w_day] parameter in a preferenze action, which can be later accessed via option/php-stats-options.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-20T22:00:00.000Z
CVE-2006-7174 
PHP remote file inclusion vulnerability in includes/functions.php in the Dimension module of phpBB allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.  NOTE: this may be the same issue as CVE-2006-5235.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-21T21:00:00.000Z
CVE-2006-7175 
The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not allow the administrator to disable SSLv2 encryption, which could cause less secure channels to be used than desired.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-27T23:00:00.000Z
CVE-2006-7176 
The version of Sendmail 8.13.1-2 on Red Hat Enterprise Linux 4 Update 4 and earlier does not reject the "localhost.localdomain" domain name for e-mail messages that come from external hosts, which might allow remote attackers to spoof messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-27T23:00:00.000Z
CVE-2006-7177 
MadWifi, when Ad-Hoc mode is used, allows remote attackers to cause a denial of service (system crash) via unspecified vectors that lead to a kernel panic in the ieee80211_input function, related to "packets coming from a 'malicious' WinXP system."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2006-7178 
MadWifi before 0.9.3 does not properly handle reception of an AUTH frame by an IBSS node, which allows remote attackers to cause a denial of service (system crash) via a certain AUTH frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2006-7179 
ieee80211_input.c in MadWifi before 0.9.3 does not properly process Channel Switch Announcement Information Elements (CSA IEs), which allows remote attackers to cause a denial of service (loss of communication) via a Channel Switch Count less than or equal to one, triggering a channel change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2006-7180 
ieee80211_output.c in MadWifi before 0.9.3 sends unencrypted packets before WPA authentication succeeds, which allows remote attackers to obtain sensitive information (related to network structure), and possibly cause a denial of service (disrupted authentication) and conduct spoofing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T01:00:00.000Z
CVE-2006-7181 
Multiple PHP remote file inclusion vulnerabilities in Morcego CMS 0.9.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) fichero parameter to morcegoCMS.php or the (2) path parameter to adodb/adodb.inc.php.  NOTE: vector 1 has been disputed by a third party who shows that $fichero can not be controlled by an attacker
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T10:00:00.000Z
CVE-2006-7182 
PHP remote file inclusion vulnerability in noticias.php in MNews 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T10:00:00.000Z
CVE-2006-7183 
PHP remote file inclusion vulnerability in styles.php in Exhibit Engine (EE) 1.22 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T21:00:00.000Z
CVE-2006-7184 
Multiple PHP remote file inclusion vulnerabilities in Exhibit Engine (EE) 1.22, and possibly earlier, allow remote attackers to execute arbitrary PHP code via a URL in the toroot parameter to (1) fetchsettings.php or (2) fstyles.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T21:00:00.000Z
CVE-2006-7185 
PHP remote file inclusion vulnerability in includes/user_standard.php in CMSmelborp Beta allows remote attackers to execute arbitrary PHP code via a URL in the relative_root parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-03-30T21:00:00.000Z
CVE-2006-7186 
cgi-lib/subs.pl in web-app.net WebAPP before 0.9.9.3.5 allows attackers to open list files in "profile and other functions," a different vulnerability than CVE-2005-0927.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-03T00:00:00.000Z
CVE-2006-7187 
Cross-site scripting (XSS) vulnerability in the show_recent_searches function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to inject arbitrary web script or HTML via the srch variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-03T00:00:00.000Z
CVE-2006-7188 
The search function in cgi-lib/user-lib/search.pl in web-app.net WebAPP before 20060909 allows remote attackers to read internal forum posts via certain requests, possibly related to the $info{'forum'} variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-03T00:00:00.000Z
CVE-2006-7189 
Cross-site scripting (XSS) vulnerability in cgi-bin/admin/logs.cgi in web-app.net WebAPP before 20060403 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the Statistics Log Viewer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-03T00:00:00.000Z
CVE-2006-7190 
Cross-site scripting (XSS) vulnerability in cgi-bin/user-lib/topics.pl in web-app.net WebAPP before 20060515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the viewnews function, related to use of doubbctopic instead of doubbc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-03T00:00:00.000Z
CVE-2006-7191 
Untrusted search path vulnerability in lamdaemon.pl in LDAP Account Manager (LAM) before 1.0.0 allows local users to gain privileges via a modified PATH that points to a malicious rm program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-03T00:00:00.000Z
CVE-2006-7192 
Microsoft ASP .NET Framework 2.0.50727.42 does not properly handle comment (/* */) enclosures, which allows remote attackers to bypass request filtering and conduct cross-site scripting (XSS) attacks, or cause a denial of service, as demonstrated via an xss:expression STYLE attribute in a closing XSS HTML tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-10T22:00:00.000Z
CVE-2006-7193 
PHP remote file inclusion vulnerability in unit_test/test_cases.php in Smarty 2.6.1 allows remote attackers to execute arbitrary PHP code via a URL in the SMARTY_DIR parameter.  NOTE: this issue is disputed by CVE and a third party because SMARTY_DIR is a constant
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-12T19:00:00.000Z
CVE-2006-7194 
PHP remote file inclusion vulnerability in modules/Mysqlfinder/MysqlfinderAdmin.php in Agora 1.4 RC1, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the _SESSION[PATH_COMPOSANT] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-18T10:00:00.000Z
CVE-2006-7195 
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T22:00:00.000Z
CVE-2006-7196 
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T22:00:00.000Z
CVE-2006-7197 
The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-25T20:00:00.000Z
CVE-2006-7198 
Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 5.1.1.14, and WAS for z/OS 601 before 6.0.2.13, has unknown impact and attack vectors, related to a "Potential security exposure," aka PK26123.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T22:00:00.000Z
CVE-2006-7199 
EMC RSA Security SiteKey allows remote attackers to display the correct image via a man-in-the-middle (MITM) attack in which an attacker-controlled server proxies authentication data to and from a legitimate SiteKey server.  NOTE: the vendor disputes the severity of the issue, stating that it is easier to monitor this attack than "attacks against static web pages."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2006-7200 
EMC RSA Security SiteKey issues challenge-bypass tokens that persist forever without a cancellation interface for end users, which makes it easier for attackers to bypass one stage of authentication by stealing and replaying a token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2006-7201 
EMC RSA Security SiteKey does not set the secure qualifier on the SiteKey Flash token (aka the PassMark Flash shared object), which might allow remote attackers to obtain the token via HTTP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-04-30T23:00:00.000Z
CVE-2006-7202 
The dofreePDF function in includes/pdf.php in Mambo 4.6.1 does not properly check access rights for database content, which allows remote attackers to read certain content via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-09T18:00:00.000Z
CVE-2006-7203 
The compat_sys_mount function in fs/compat.c in Linux kernel 2.6.20 and earlier allows local users to cause a denial of service (NULL pointer dereference and oops) by mounting a smbfs file system in compatibility mode ("mount -t smbfs").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-14T17:00:00.000Z
CVE-2006-7204 
The imap_body function in PHP before 4.4.4 does not implement safemode or open_basedir checks, which allows local users to read arbitrary files or list arbitrary directory contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-22T19:00:00.000Z
CVE-2006-7205 
The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2 allows context-dependent attackers to cause a denial of service (memory consumption) via a large num value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-24T01:29:00.000Z
CVE-2006-7206 
Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) by creating a ADODB.Recordset object and making a series of calls to the NextRecordset method with a long string argument, which causes an "invalid memory access" in the SysFreeString function, a different issue than CVE-2006-3510 and CVE-2006-3899.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T00:00:00.000Z
CVE-2006-7207 
Buffer overflow in ageet AGEphone before 1.4.0 might allow remote attackers to have an unknown impact via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-22T18:00:00.000Z
CVE-2006-7208 
PHP remote file inclusion vulnerability in download.php in the Adam van Dongen Forum (com_forum) component (aka phpBB component) 1.2.4RC3 and earlier for Mambo allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-26T23:00:00.000Z
CVE-2006-7209 
Multiple cross-site scripting (XSS) vulnerabilities in phpTrafficA before 1.2beta2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to keywords results in the (1) main, (2) daily, (3) weekly, (4) monthly, (5) new trends, (6) individual page, and (7) search engine statistics.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-27T00:00:00.000Z
CVE-2006-7210 
Microsoft Windows 2000, XP, and Server 2003 allows remote attackers to cause a denial of service (cpu consumption) via a PNG image with crafted (1) Width and (2) Height values in the IHDR block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-27T17:00:00.000Z
CVE-2006-7211 
fb_lock_mgr in Firebird 1.5 uses weak permissions (0666) for the semaphore array, which allows local users to cause a denial of service (blocked query processing) by locking semaphores.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-29T18:00:00.000Z
CVE-2006-7212 
Multiple buffer overflows in Firebird 1.5, one of which affects WNET, have unknown impact and attack vectors.  NOTE: this issue might overlap CVE-2006-1240.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-29T18:00:00.000Z
CVE-2006-7213 
Firebird 1.5 allows remote authenticated users without SYSDBA and owner permissions to overwrite a database by creating a database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-29T18:00:00.000Z
CVE-2006-7214 
Multiple unspecified vulnerabilities in Firebird 1.5 allow remote attackers to (1) cause a denial of service (application crash) by sending many remote protocol versions; and (2) cause a denial of service (connection drop) via certain network traffic, as demonstrated by Nessus vulnerability scanning.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-06-29T18:00:00.000Z
CVE-2006-7215 
The Intel Core 2 Extreme processor X6800 and Core 2 Duo desktop processor E6000 and E4000 incorrectly set the memory page Access (A) bit for a page in certain circumstances involving proximity of the code segment limit to the end of a code page, which has unknown impact and attack vectors on certain operating systems other than OpenBSD, aka AI90.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-03T21:00:00.000Z
CVE-2006-7216 
Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2006-7217 
Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-05T20:00:00.000Z
CVE-2006-7218 
eZ publish before 3.8.1 does not properly enforce permissions for "content edit Language" when there are four or more languages, which allows remote authenticated users to perform translations into languages that are not listed in a Module Function Limitation policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z
CVE-2006-7219 
eZ publish before 3.8.5 does not properly enforce permissions for editing in a specific language, which allows remote authenticated users to create a draft in an unauthorized language by editing an archived version of an object, and then using Manage Versions to copy this version to a new draft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-07-06T19:00:00.000Z