rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-6818 
Mole Group Real Estate Script 1.1 and earlier stores passwords in cleartext, which allows context-dependent attackers to obtain sensitive information.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-01T14:00:00.000Z
CVE-2008-6819 
win32k.sys in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (system crash) via vectors related to CreateWindow, TranslateMessage, and DispatchMessage, possibly a race condition between threads, a different vulnerability than CVE-2008-1084.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-01T19:00:00.000Z
CVE-2008-6820 
The db2fmp process in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 on Windows runs with "OS privilege," which has unknown impact and attack vectors, a different vulnerability than CVE-2008-3856.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-03T20:35:00.000Z
CVE-2008-6821 
Buffer overflow in the DAS server in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP2 might allow attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, a different vulnerability than CVE-2007-3676 and CVE-2008-3853.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-03T20:35:00.000Z
CVE-2008-6822 
Unrestricted file upload vulnerability in uploadp.php in New Earth Programming Team (NEPT) imgupload (aka Image Uploader) 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension and a modified content type, then accessing this file via a direct request, as demonstrated by an upload with an image/jpeg content type.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-04T16:00:00.000Z
CVE-2008-6823 
Multiple cross-site request forgery (CSRF) vulnerabilities in the management interface on the A-LINK WL54AP3 and WL54AP2 access points before firmware 1.4.2-eng1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify the network configuration via certain parameters to goform/formWanTcpipSetup or (2) modify credentials via certain parameters to goform/formPasswordSetup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-04T16:00:00.000Z
CVE-2008-6824 
The management interface on the A-LINK WL54AP3 and WL54AP2 access points has a blank default password for the admin account, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-04T16:00:00.000Z
CVE-2008-6825 
Directory traversal vulnerability in user/index.php in Fonality trixbox CE 2.6.1 and earlier allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the langChoice parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-05T21:00:00.000Z
CVE-2008-6826 
dhtml.pl in MHF Media Pro allows remote attackers to execute arbitrary commands via shell metacharacters in the page parameter, as demonstrated using the (1) advert_top.htm or (2) advert_login.htm pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-08T19:00:00.000Z
CVE-2008-6827 
The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-08T19:00:00.000Z
CVE-2008-6828 
Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 stores the Application Identity Account password in memory in cleartext, which allows local users to gain privileges and modify clients of the Deployment Solution Server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-08T19:00:00.000Z
CVE-2008-6829 
VicFTPS 5.0 allows remote attackers to cause a denial of service (crash) via a LIST command that starts with a "/\/" (forward slash, backward slash, forward slash).  NOTE: this might be the same issue as CVE-2008-2031.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-08T19:00:00.000Z
CVE-2008-6830 
The disconnection feature in Citrix Web Interface 5.0 and 5.0.1 for Java Application Servers does not properly terminate a user's web interface session, which allows attackers with access to the same browser instance to gain access to the user's Web Interface session. NOTE: the attacker must also have valid credentials to the Web Interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-08T19:00:00.000Z
CVE-2008-6831 
Multiple cross-site scripting (XSS) vulnerabilities in Atlassian JIRA Enterprise Edition 3.13 allow remote attackers to inject arbitrary web script or HTML via the (1) fullname (Full Name) parameter in the ViewProfile page or (2) returnUrl parameter in a form, as demonstrated using secure/AddComment!default.jspa (aka "Add Comment").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-08T19:00:00.000Z
CVE-2008-6832 
Cross-site request forgery (CSRF) vulnerability in Atlassian JIRA Enterprise Edition 3.13 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-08T19:00:00.000Z
CVE-2008-6833 
Directory traversal vulnerability in commsrss.php in fuzzylime (cms) before 3.01b allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in a files array element for a blogs action, as demonstrated by the files[0] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-22T20:00:00.000Z
CVE-2008-6834 
Multiple directory traversal vulnerabilities in fuzzylime (cms) 3.01 and 3.01a allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the s parameter to code/commupdate.php in a count action or (2) the heads parameter to code/newsheads.php.  NOTE: the blog.php vector is already covered by CVE-2008-3164.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-22T20:00:00.000Z
CVE-2008-6835 
Cross-site scripting (XSS) vulnerability in OpenID 5.x before 5.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2008-6836 
Cross-site request forgery (CSRF) vulnerability in OpenID 5.x before 5x.-1.2, a module for Drupal, allows remote attackers to hijack the authentication of unspecified victims to delete OpenID identities via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2008-6837 
SQL injection vulnerability in Zoph 0.7.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, a different issue than CVE-2008-3258.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2008-6838 
Cross-site scripting (XSS) vulnerability in search.php in Zoph 0.7.2.1 allows remote attackers to inject arbitrary web script or HTML via the _off parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2008-6839 
Multiple cross-site scripting (XSS) vulnerabilities in TGS Content Management 0.3.2r2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg and (2) goodmsg parameters to (a) login.php and (b) index.php, and the (3) dir and (4) id parameters to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2008-6840 
Multiple PHP remote file inclusion vulnerabilities in V-webmail 1.6.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) CONFIG[pear_dir] parameter to (a) Mail/RFC822.php, (b) Net/Socket.php, (c) XML/Parser.php, (d) XML/Tree.php, (e) Mail/mimeDecode.php, (f) Console/Getopt.php, (g) System.php, (h) Log.php, and (i) File.php in includes/pear/; the CONFIG[pear_dir] parameter to (j) includes/prepend.php, and (k) includes/cachedConfig.php; and the (2) CONFIG[includes] parameter to (l) prepend.php and (m) email.list.search.php in includes/.  NOTE: the CONFIG[pear_dir] parameter to includes/mailaccess/pop3.php is already covered by CVE-2006-2666.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2008-6841 
PHP remote file inclusion vulnerability in the Green Mountain Information Technology and Consulting Database Query (com_dbquery) component 1.4.1.1 and earlier for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to classes/DBQ/admin/common.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2008-6842 
Directory traversal vulnerability in data/modules/blog/module_pages_site.php in Pluck 4.6.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the post parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2008-6843 
Directory traversal vulnerability in index.php in Fantastico, as used with cPanel 11.x, allows remote attackers to read arbitrary files via a .. (dot dot) in the sup3r parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2008-6844 
The registration view (/user/register) in eZ Publish 3.5.6 and earlier, and possibly other versions before 3.9.5, 3.10.1, and 4.0.1, allows remote attackers to gain privileges as other users via modified ContentObjectAttribute_data_user_login_30, ContentObjectAttribute_data_user_password_30, and other parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2008-6845 
The unpack feature in ClamAV 0.93.3 and earlier allows remote attackers to cause a denial of service (segmentation fault) via a corrupted LZH file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2008-6846 
Multiple stack-based buffer overflows in avast! Linux Home Edition 1.0.5, 1.0.5-1, and 1.0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via a malformed (1) ISO or (2) RPM file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2008-6847 
Cross-site scripting (XSS) vulnerability in Employee/emp_login.asp in Pre ASP Job Board allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2008-6848 
Cross-site scripting (XSS) vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to inject arbitrary web script or HTML via the category parameter in a select action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2008-6849 
Unrestricted file upload vulnerability in index.php in phpGreetCards 3.7 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a via a link that is listed by userfiles/number_shell.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2008-6850 
Cross-site scripting (XSS) vulnerability in messages.php in PHP-Fusion 6.01.17 and 7.00.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2008-6851 
SQL injection vulnerability in page.php in PHP Link Directory (phpLD) 3.3, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2008-6852 
SQL injection vulnerability in the Ice Gallery (com_ice) component 0.5 beta 2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2008-6853 
SQL injection vulnerability in modules/poll/index.php in AIST NetCat 3.0 and 3.12 allows remote attackers to execute arbitrary SQL commands via the PollID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2008-6854 
Xigla Software Absolute FAQ Manager.NET 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6855 
Xigla Software Absolute News Feed 1.0 and possibly 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a certain cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6856 
Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6857 
Absolute Podcast .NET 1.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6858 
Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6859 
Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6860 
Xigla Software Absolute Poll Manager XE 4.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6861 
Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6862 
Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6863 
Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6864 
Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6865 
SQL injection vulnerability in modules.php in the Sectionsnew module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printpage action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6866 
SQL injection vulnerability in modules.php in the Current_Issue module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the id parameter in a summary action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6867 
SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T14:00:00.000Z
CVE-2008-6868 
Cross-site scripting (XSS) vulnerability in default/login.php in EditeurScripts EsBaseAdmin 2.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T19:00:00.000Z
CVE-2008-6869 
Oramon Oracle Database Monitoring Tool 2.0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for config/oramon.ini.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T19:00:00.000Z
CVE-2008-6870 
Merlix Educate Server allows remote attackers to bypass intended security restrictions and obtain sensitive information via a direct request to (1) config.asp and (2) users.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T19:00:00.000Z
CVE-2008-6871 
Merlix Educate Server stores db.mdb under the web root with insufficient access control, which allows remote attackers to obtain unspecified sensitive information via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T19:00:00.000Z
CVE-2008-6872 
ASPThai.NET ASPThai Forums 8.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/aspthaiForum.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T19:00:00.000Z
CVE-2008-6873 
SQL injection vulnerability in Active Web Mail 4.0 allows remote attackers to execute arbitrary SQL commands via the TabOpenQuickTab1 parameter to (1) popaccounts.aspx, (2) addressbook.aspx, and (3) emails.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T19:00:00.000Z
CVE-2008-6874 
Multiple SQL injection vulnerabilities in ASP SiteWare autoDealer 1 and 2 allow remote attackers to execute arbitrary SQL commands via the iType parameter in (1) Auto1/type.asp or (2) auto2/type.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2008-6875 
SQL injection vulnerability in default.asp in ASP Product Catalog allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2007-5220.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2008-6876 
Cross-site scripting (XSS) vulnerability in login.php in EsPartenaires 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: the EsContacts 1.0 issue is covered in CVE-2008-2037.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T18:00:00.000Z
CVE-2008-6877 
Directory traversal vulnerability in admin/includes/initsystem.php in Zen Cart 1.3.8 and 1.3.8a, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the loader_file parameter.  NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2008-6878 
Directory traversal vulnerability in admin/includes/languages/english.php in Zen Cart 1.3.8a, 1.3.8, and earlier, when .htaccess is not supported, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the _SESSION[language] parameter.  NOTE: the vendor disputes this issue, stating "at worst, the use of this vulnerability will reveal some local file paths.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2008-6879 
Cross-site scripting (XSS) vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T19:00:00.000Z
CVE-2008-6880 
SQL injection vulnerability in joke.php in EasySiteNetwork Free Jokes Website allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T19:00:00.000Z
CVE-2008-6881 
Multiple SQL injection vulnerabilities in the Live Chat (com_livechat) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the last parameter to (1) getChat.php, (2) getChatRoom.php, and (3) getSavedChatRooms.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T19:00:00.000Z
CVE-2008-6882 
Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to use the xmlhttp.php script as an open HTTP proxy to hide network scanning activities or scan internal networks via a GET request with a full URL in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T19:00:00.000Z
CVE-2008-6883 
SQL injection vulnerability in the Live Chat (com_livechat) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the last parameter to getChatRoom.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T19:08:00.000Z