rainbutterfly/cve_corpus huggingface dataset:
CVE-2008-3599 
SQL injection vulnerability in image.php in OpenImpro 1.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3600 
Directory traversal vulnerability in contrib/phpBB2/modules.php in Gallery 1.5.7 and 1.6-alpha3, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phpEx parameter within a modload action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3601 
SQL injection vulnerability in index.php in Quicksilver Forums 1.4.1 allows remote attackers to execute arbitrary SQL commands via the forums array parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3602 
admin/wr_admin.php in PHP-Ring Webring System (aka uPHP_ring_website) 0.9.1 allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3603 
SQL injection vulnerability in index.php in Vacation Rental Script 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter in a sections action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3604 
SQL injection vulnerability in bannerclick.php in ZeeBuddy 2.1 allows remote attackers to execute arbitrary SQL commands via the adid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3605 
Unspecified vulnerability in McAfee Encrypted USB Manager 3.1.0.0, when the Re-use Threshold for passwords is nonzero, allows remote attackers to conduct offline brute force attacks via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3606 
Heap-based buffer overflow in the IMAP service in Qbik WinGate 6.2.2.1137 and earlier allows remote authenticated users to cause a denial of service (resource exhaustion) or possibly execute arbitrary code via a long argument to the LIST command.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3607 
The IMAP server in NoticeWare Email Server NG 4.6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via multiple long LOGIN commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T19:00:00.000Z
CVE-2008-3608 
ImageIO in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows context-dependent attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via a crafted JPEG image with an embedded ICC profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3609 
The kernel in Apple Mac OS X 10.5 through 10.5.4 does not properly flush cached credentials during recycling (aka purging) of a vnode, which might allow local users to bypass the intended read or write permissions of a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3610 
Race condition in Login Window in Apple Mac OS X 10.5 through 10.5.4, when a blank-password account is enabled, allows attackers to bypass password authentication and login to any account via multiple attempts to login to the blank-password account, followed by selection of an arbitrary account from the user list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3611 
Login Window in Apple Mac OS X 10.4.11 does not clear the current password when a user makes a password-change attempt that is denied by policy, which allows opportunistic, physically proximate attackers to bypass authentication and change this user's password by later entering an acceptable new password on the same login screen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3612 
The Networking subsystem in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, uses predictable TCP initial sequence numbers, which allows remote attackers to spoof or hijack a TCP connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3613 
Finder in Apple Mac OS X 10.5.2 through 10.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors involving a search for a remote disk on the local network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3614 
Integer overflow in Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image, which triggers heap corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3615 
ir50_32.qtx in an unspecified third-party Indeo v5 codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, accesses uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3616 
Multiple integer overflows in the SearchKit API in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via vectors associated with "passing untrusted input" to unspecified API functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3617 
Remote Management and Screen Sharing in Apple Mac OS X 10.5 through 10.5.4, when used to set a password for a VNC viewer, displays additional input characters beyond the maximum password length, which might make it easier for attackers to guess passwords that the user believed were longer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3618 
The File Sharing pane in the Sharing preference pane in Apple Mac OS X 10.5 through 10.5.4 does not inform users that the complete contents of their own home directories are shared for their own use, which might allow attackers to leverage other vulnerabilities and access files for which sharing was unintended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3619 
Time Machine in Apple Mac OS X 10.5 through 10.5.4 uses weak permissions for Time Machine Backup log files, which allows local users to obtain sensitive information by reading these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3621 
VideoConference in Apple Mac OS X 10.4.11 and 10.5 through 10.5.4 allows remote attackers to cause a denial of service (memory corruption and application crash) or execute arbitrary code via vectors involving H.264 encoded media.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3622 
Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5 through 10.5.4 allows remote attackers to inject arbitrary web script or HTML via an e-mail message that reaches a mailing-list archive, aka "persistent JavaScript injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-16T23:00:00.000Z
CVE-2008-3623 
Heap-based buffer overflow in CoreGraphics in Apple Safari before 3.2 on Windows, in iPhone OS 1.0 through 2.2.1, and in iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image, related to improper handling of color spaces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-3624 
Heap-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a QuickTime Virtual Reality (QTVR) movie file with crafted panorama atoms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3625 
Stack-based buffer overflow in Apple QuickTime before 7.5.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a QuickTime Virtual Reality (QTVR) movie file with crafted (1) maxTilt, (2) minFieldOfView, and (3) maxFieldOfView elements in panorama track PDAT atoms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3626 
The CallComponentFunctionWithStorage function in Apple QuickTime before 7.5.5 does not properly handle a large entry in the sample_size_table in STSZ atoms, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3627 
Apple QuickTime before 7.5.5 does not properly handle (1) MDAT atoms in MP4 video files within QuickTimeH264.qtx, (2) MDAT atoms in mov video files within QuickTimeH264.scalar, and (3) AVC1 atoms in an unknown media type within an unspecified component, which allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via a crafted, H.264 encoded movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3628 
Apple QuickTime before 7.5.5 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image, related to an "invalid pointer issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3629 
Apple QuickTime before 7.5.5 allows remote attackers to cause a denial of service (application crash) via a crafted PICT image that triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3630 
mDNSResponder in Apple Bonjour for Windows before 1.0.5, when an application uses the Bonjour API for unicast DNS, does not choose random values for transaction IDs or source ports in DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3631 
Application Sandbox in Apple iPod touch 2.0 through 2.0.2, and iPhone 2.0 through 2.0.2, does not properly isolate third-party applications, which allows attackers to read arbitrary files in a third-party application's sandbox via a different third-party application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3632 
Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone 1.0 through 2.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a web page with crafted Cascading Style Sheets (CSS) import statements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3634 
Apple iTunes before 8.0 on Mac OS X 10.4.11, when iTunes Music Sharing is enabled but blocked by the host-based firewall, presents misleading information about firewall security, which might allow remote attackers to leverage an exposure that would be absent if the administrator were given better information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3635 
Stack-based buffer overflow in QuickTimeInternetExtras.qtx in an unspecified third-party Indeo v3.2 (aka IV32) codec for QuickTime, when used with Apple QuickTime before 7.5.5 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3636 
Integer overflow in the IopfCompleteRequest API in the kernel in Microsoft Windows 2000, XP, Server 2003, and Vista allows context-dependent attackers to gain privileges. NOTE: this issue was originally reported for GEARAspiWDM.sys 2.0.7.5 in Gear Software CD DVD Filter driver before 4.001.7, as used in other products including Apple iTunes and multiple Symantec and Norton products, which allows local users to gain privileges via repeated IoAttachDevice IOCTL calls to \\.\GEARAspiWDMDevice in this GEARAspiWDM.sys.  However, the root cause is the integer overflow in the API call itself.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-10T16:00:00.000Z
CVE-2008-3637 
The Hash-based Message Authentication Code (HMAC) provider in Java on Apple Mac OS X 10.4.11, 10.5.4, and 10.5.5 uses an uninitialized variable, which allows remote attackers to execute arbitrary code via a crafted applet, related to an "error checking issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-26T16:00:00.000Z
CVE-2008-3638 
Java on Apple Mac OS X 10.5.4 and 10.5.5 does not prevent applets from accessing file:// URLs, which allows remote attackers to execute arbitrary programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-26T16:00:00.000Z
CVE-2008-3639 
Heap-based buffer overflow in the read_rle16 function in imagetops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via an SGI image with malformed Run Length Encoded (RLE) data containing a small image and a large row count.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-14T20:00:00.000Z
CVE-2008-3640 
Integer overflow in the WriteProlog function in texttops in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-14T20:00:00.000Z
CVE-2008-3641 
The Hewlett-Packard Graphics Language (HPGL) filter in CUPS before 1.3.9 allows remote attackers to execute arbitrary code via crafted pen width and pen color opcodes that overwrite arbitrary memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-3642 
Buffer overflow in ColorSync in Mac OS X 10.4.11 and 10.5.5 allows remote attackers to cause a denial of service (application termination) and possibly execute arbitrary code via an image with a crafted ICC profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-3643 
Unspecified vulnerability in Finder in Mac OS X 10.5.5 allows user-assisted attackers to cause a denial of service (continuous termination and restart) via a crafted Desktop file that generates an error when producing its icon, related to an "error recovery issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-3644 
Apple Safari before 3.2 does not properly prevent caching of form data for form fields that have autocomplete disabled, which allows local users to obtain sensitive information by reading the browser's page cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-11-17T18:00:00.000Z
CVE-2008-3645 
Heap-based buffer overflow in the local IPC component in the EAPOLController plugin for configd (Networking component) in Mac OS X 10.4.11 and 10.5.5 allows local users to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-3646 
The Postfix configuration file in Mac OS X 10.5.5 causes Postfix to be network-accessible when mail is sent from a local command-line tool, which allows remote attackers to send mail to local Mac OS X users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-3647 
Buffer overflow in PSNormalizer in Mac OS X 10.4.11 and 10.5.5 allows remote attackers to cause a denial of service (application termination) and execute arbitrary code via a PostScript file with a crafted bounding box comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-10-10T10:00:00.000Z
CVE-2008-3648 
nslookup.exe in Microsoft Windows XP SP2 allows user-assisted remote attackers to execute arbitrary code, as demonstrated by an attempted DNS zone transfer, and as exploited in the wild in August 2008.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-12T23:00:00.000Z
CVE-2008-3649 
SQL injection vulnerability in categorydetail.php in Article Friendly Standard allows remote attackers to execute arbitrary SQL commands via the Cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T00:00:00.000Z
CVE-2008-3650 
Multiple unspecified vulnerabilities in Horde Groupware Webmail before Edition 1.1.1 (final) have unknown impact and attack vectors related to "unescaped output," possibly cross-site scripting (XSS), in the (1) object browser and (2) contact view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3651 
Memory leak in racoon/proposal.c in the racoon daemon in ipsec-tools before 0.7.1 allows remote authenticated users to cause a denial of service (memory consumption) via invalid proposals.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3652 
src/racoon/handler.c in racoon in ipsec-tools does not remove an "orphaned ph1" (phase 1) handle when it has been initiated remotely, which allows remote attackers to cause a denial of service (resource consumption).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3653 
Multiple unspecified vulnerabilities in TikiWiki CMS/Groupware before 2.0 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3654 
Unspecified vulnerability in TikiWiki CMS/Groupware before 2.0 allows attackers to obtain "path and PHP configuration" via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3655 
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3656 
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3657 
The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-13T01:00:00.000Z
CVE-2008-3658 
Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-15T00:00:00.000Z
CVE-2008-3659 
Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function.  NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safe_mode are feasible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-15T00:00:00.000Z
CVE-2008-3660 
PHP 4.4.x before 4.4.9, and 5.x through 5.2.6, when used as a FastCGI module, allows remote attackers to cause a denial of service (crash) via a request with multiple dots preceding the extension, as demonstrated using foo..php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-08-15T00:00:00.000Z
CVE-2008-3661 
Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-23T15:00:00.000Z
CVE-2008-3662 
Gallery before 1.5.9, and 2.x before 2.2.6, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-18T18:00:00.000Z
CVE-2008-3663 
Squirrelmail 1.4.15 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2008-09-24T14:00:00.000Z