rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-2773 
admin/redigera/redigera2.asp in Hogstorps hogstorp Guestbook 2.0 does not verify user credentials, which allows remote attackers to edit arbitrary posts via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T10:00:00.000Z
CVE-2006-2774 
Cross-site scripting (XSS) vulnerability in search.php in QontentOne CMS allows remote attackers to inject arbitrary web script or HTML via the search_phrase parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T10:00:00.000Z
CVE-2006-2775 
Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T18:00:00.000Z
CVE-2006-2776 
Certain privileged UI code in Mozilla Firefox and Thunderbird before 1.5.0.4 calls content-defined setters on an object prototype, which allows remote attackers to execute code at a higher privilege than intended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T18:00:00.000Z
CVE-2006-2777 
Unspecified vulnerability in Mozilla Firefox before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to execute arbitrary code by using the nsISelectionPrivate interface of the Selection object to add a SelectionListener and create notifications that are executed in a privileged context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T18:00:00.000Z
CVE-2006-2778 
The crypto.signText function in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to execute arbitrary code via certain optional Certificate Authority name arguments, which causes an invalid array index and triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T18:00:00.000Z
CVE-2006-2779 
Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) nested <option> tags in a select tag, (2) a DOMNodeRemoved mutation event, (3) "Content-implemented tree views," (4) BoxObjects, (5) the XBL implementation, (6) an iframe that attempts to remove itself, which leads to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T19:00:00.000Z
CVE-2006-2780 
Integer overflow in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via "jsstr tagify," which leads to memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T19:00:00.000Z
CVE-2006-2781 
Double free vulnerability in nsVCard.cpp in Mozilla Thunderbird before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via a VCard that contains invalid base64 characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T19:00:00.000Z
CVE-2006-2782 
Firefox 1.5.0.2 does not fix all test cases associated with CVE-2006-1729, which allows remote attackers to read arbitrary files by inserting the target filename into a text box, then turning that box into a file upload control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T19:00:00.000Z
CVE-2006-2783 
Mozilla Firefox and Thunderbird before 1.5.0.4 strip the Unicode Byte-order-Mark (BOM) from a UTF-8 page before the page is passed to the parser, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a BOM sequence in the middle of a dangerous tag such as SCRIPT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T19:00:00.000Z
CVE-2006-2784 
The PLUGINSPAGE functionality in Mozilla Firefox before 1.5.0.4 allows remote user-assisted attackers to execute privileged code by tricking a user into installing missing plugins and selecting the "Manual Install" button, then using nested javascript: URLs.  NOTE: the manual install button is used for downloading software from a remote web site, so this issue would not cross privilege boundaries if the user progresses to the point of installing malicious software from the attacker-controlled site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T19:00:00.000Z
CVE-2006-2785 
Cross-site scripting (XSS) vulnerability in Mozilla Firefox before 1.5.0.4 allows user-assisted remote attackers to inject arbitrary web script or HTML by tricking a user into (1) performing a "View Image" on a broken image in which the SRC attribute contains a Javascript URL, or (2) selecting "Show only this frame" on a frame whose SRC attribute contains a Javascript URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T19:00:00.000Z
CVE-2006-2786 
HTTP response smuggling vulnerability in Mozilla Firefox and Thunderbird before 1.5.0.4, when used with certain proxy servers, allows remote attackers to cause Firefox to interpret certain responses as if they were responses from two different sites via (1) invalid HTTP response headers with spaces between the header name and the colon, which might not be ignored in some cases, or (2) HTTP 1.1 headers through an HTTP 1.0 proxy, which are ignored by the proxy but processed by the client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T20:00:00.000Z
CVE-2006-2787 
EvalInSandbox in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to gain privileges via javascript that calls the valueOf method on objects that were created outside of the sandbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T20:00:00.000Z
CVE-2006-2788 
Double free vulnerability in the getRawDER function for nsIX509Cert in Firefox allows remote attackers to cause a denial of service (hang) and possibly execute arbitrary code via certain Javascript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T21:00:00.000Z
CVE-2006-2789 
Evolution 2.2.x and 2.3.x in GNOME 2.7 and 2.8, when "load images if sender in addressbook" is enabled, allows remote attackers to cause a denial of service (persistent crash) via a crafted "From" header that triggers an assert error in camel-internet-address.c when a null pointer is used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T22:00:00.000Z
CVE-2006-2790 
A package component in Sun Storage Automated Diagnostic Environment (StorADE) 2.4 uses world-writable permissions for certain critical files and directories, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-02T22:00:00.000Z
CVE-2006-2791 
Directory traversal vulnerability in index.php in iBoutique.MALL and possibly iBoutique allows remote attackers to read arbitrary files via ".." sequences in the function parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2792 
SQL injection vulnerability in misc.php in Woltlab Burning Board (WBB) 2.3.4 allows remote attackers to execute arbitrary SQL commands via the sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2793 
SQL injection vulnerability in Anket.asp in ASPSitem 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the hid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2794 
Hesabim.asp in ASPSitem 2.0 and earlier allows remote attackers to read private messages of other users via a modified id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2795 
Multiple cross-site scripting (XSS) vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via (1) the xtref parameter in xiti.js and (2) an HTTP Referer header field.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2796 
Cross-site scripting (XSS) vulnerability in gallery.php in Captivate 1.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter, which is reflected in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2797 
Multiple SQL injection vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to execute arbitrary SQL commands via the (1) CalendarDetailsID parameter in (a) month.php, (b) day.php, and (c) delCalendar.php; (2) ID parameter in (d) event.php; (3) AdminUserID parameter in (e) delAdmin.php; (4) EventLocationID parameter in (f) delAddress.php; and (5) LocationID parameter in (g) delCategory.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2798 
Multiple cross-site scripting (XSS) vulnerabilities in phpCommunityCalendar 4.0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) LoName parameter in (a) week.php and (b) month.php and (2) AddressLink parameter in (c) event.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T01:00:00.000Z
CVE-2006-2799 
Cross-site scripting (XSS) vulnerability in content_footer.php in toendaCMS 0.7.0 allows remote attackers to inject arbitrary web scripts or HTML via the print_url variable.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T10:00:00.000Z
CVE-2006-2800 
Multiple cross-site scripting (XSS) vulnerabilities in Unak CMS 1.5 RC2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) u_a or (2) u_s parameters.  NOTE: this might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T10:00:00.000Z
CVE-2006-2801 
Multiple SQL injection vulnerabilities in Unak CMS 1.5 RC2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) u_a or (2) u_s parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T10:00:00.000Z
CVE-2006-2802 
Buffer overflow in the HTTP Plugin (xineplug_inp_http.so) for xine-lib 1.1.1 allows remote attackers to cause a denial of service (application crash) via a long reply from an HTTP server, as demonstrated using gxine 0.5.6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T10:00:00.000Z
CVE-2006-2803 
Multiple cross-site scripting (XSS) vulnerabilities in PHP ManualMaker 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) id parameter to index.php, (2) search field (possibly the s parameter), or (3) comment field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T10:00:00.000Z
CVE-2006-2804 
Cross-site scripting (XSS) vulnerability in index.cfm in Goss Intelligent Content Management (iCM) 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T10:00:00.000Z
CVE-2006-2805 
SQL injection vulnerability in VBulletin 3.0.10 allows remote attackers to execute arbitrary SQL commands via the featureid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-03T10:00:00.000Z
CVE-2006-2806 
The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2807 
ASPwebSoft Speedy Asp Discussion Forum allows remote attackers to change the password of any account via a modified account id and possibly arbitrary values of the name, email, country, password, and passwordre parameters to profileupdate.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2808 
Cross-site scripting (XSS) vulnerability in Lycos Tripod htmlGEAR guestGEAR (aka Guest Gear) allows remote attackers to inject arbitrary web script or HTML via a guestbook post containing a javascript URI in the SRC attribute of the BR element after an extra "iframe" tagname within that element, followed by a double ">", which might bypass cleansing operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2809 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in ar-blog 5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) count parameter, and possibly the (2) next, (3) Year_the_news, and (4) mo parameters.  NOTE: the year and month vectors are already covered by CVE-2006-0333.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2810 
Multiple cross-site scripting (XSS) vulnerabilities in Belchior Foundry vCard 2.9 allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) toprated.php and (2) newcards.php.  NOTE: the card_id vector is already covered by CVE-2006-1230.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2811 
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the babInstallPath parameter in (1) index.php, (2) topman.php, (3) approb.php, (4) vacadmb.php, (5) vacadma.php, (6) vacadm.php, (7) statart.php, (8) search.php, (9) posts.php, (10) options.php, (11) login.php, (12) frchart.php, (13) flbchart.php, (14) fileman.php, (15) faq.php, (16) event.php, (17) directory.php, (18) articles.php, (19) artedit.php, (20) calday.php, and additional unspecified PHP scripts.  NOTE: the utilit.php vector is already covered by CVE-2005-1964.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2812 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Dominios Europa PICRATE (aka TAL RateMyPic) 1.0 allow remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element in the (1) name (aka nick), (2) email, and (3) comment boxes; and via the (4) id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2813 
Directory traversal vulnerability in easy-scart.cgi in iShopCart allows remote attackers to read arbitrary files via a .. (dot dot) in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2814 
Multiple buffer overflows in the (1) vGetPost and (2) main functions in easy-scart.c through easy-scart6.c in iShopCart allow remote attackers to execute arbitrary code by sending a large amount of data containing "Submit" in an sslinvoice action, and allow remote attackers to have an unknown impact via a large amount of posted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2815 
Multiple cross-site scripting (XSS) vulnerabilities in Two Shoes M-Factory (TSMF) SimpleBoard 1.1.0 Stable (aka com_simpleboard), as used in Mambo and Joomla!, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in "post ne topic" in the Frontend, (2) the Title (aka Community-Title) field in Simpleboard Configuration in the Backend Admin Panel, and the (3) Name (aka Forum-Title) and (4) Name (aka Category-Title) fields in Simpleboard Administration in the Backend Admin Panel.  NOTE: some sources have stated that the sb_authorname parameter is affected, but it is unclear which field is related to it.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2816 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in coolphp magazine allow remote attackers to inject arbitrary web script or HTML via the (1) op and (2) nick parameters, and possibly the (3) 0000, (4) userinfo, (5) comp_der, (6) encuestas, and (7) pagina parameters.  NOTE: it is not clear whether this is a distributable product or a site-specific vulnerability. If it is site-specific, then it should not be included in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2817 
SQL injection vulnerability in bolum.php in tekno.Portal allows remote attackers to execute arbitrary SQL commands via the id parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2818 
PHP remote file inclusion vulnerability in common-menu.php in Cameron McKay Informium 0.12.0 allows remote attackers to execute arbitrary PHP code via a URL in the CONF[local_path] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2819 
PHP remote file inclusion vulnerability in Wiki.php in Barnraiser Igloo 0.1.9 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the c_node[class_path] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2820 
Cross-site scripting (XSS) vulnerability in HotWebScripts.com Weblog Oggi 1.0 allows remote attackers to inject arbitrary web script or HTML via a comment, possibly involving a javascript URI in the SRC attribute of an IMG element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2821 
Multiple cross-site scripting (XSS) vulnerabilities in DeltaScripts Pro Publish allow remote attackers to inject arbitrary web script or HTML via the (1) artid parameter in art.php and the (2) catname parameter in cat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2822 
SQL injection vulnerability in admin/default.asp in Dusan Drobac CodeAvalanche FreeForum (aka CAForum) 1.0 allows remote attackers to execute arbitrary SQL commands via the password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2823 
Katrien De Graeve a.shopKart 2.0 (aka ashopKart20) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) admin/scart.mdb and possibly (2) admin/scart97.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2824 
Logicalware MailManager before 2.0.10 does not remove 0xc8 0x27 (0xc8 followed by a single-quote character) from the data stream to the server, which allows remote attackers to modify data and gain administrative access when PostgreSQL is used, aka "bug #1494281 - Postgres encoding security hole."  NOTE: while this issue involves PostgreSQL, it is specific to MailManager's interface to PostgreSQL and is therefore a different vulnerability than CVE-2006-2313 and CVE-2006-2314.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2825 
cPanel does not automatically synchronize the PHP open_basedir configuration directive between the main server and virtual hosts that share physical directories, which might allow a local user to bypass open_basedir restrictions and access other virtual hosts via a PHP script that uses a main server URL (such as ~username) that is blocked by the user's own open_basedir directive, but not the main server's open_basedir directive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2826 
SQL injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a allows remote attackers to execute arbitrary SQL commands via the id variable, which is set by a client through a query string or a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2827 
SQL injection vulnerability in search.php in X-Cart Gold and Pro 4.0.18, and X-Cart 4.1.0 beta 1, allows remote attackers to execute arbitrary SQL commands via the "Search for pattern" field, when the settings specify only "Search in Detailed description" and "Search also in ISBN."  NOTE: the vendor disputed this issue in a comment on the original researcher's blog, saying "the bug does not impose any security threat and remote attackers can't add, modify, or delete information in the back-end database by sending specially-crafted SQL statements to the search.php script using various search parameters." As of 20060605, the original blog entry is unavailable, although ISS also reports the same dispute.  CVE has not been able to investigate this issue further, although the researcher sometimes makes inaccurate claims
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T17:00:00.000Z
CVE-2006-2828 
Global variable overwrite vulnerability in PHP-Nuke allows remote attackers to conduct remote PHP file inclusion attacks via a modified phpbb_root_path parameter to the admin scripts (1) index.php, (2) admin_ug_auth.php, (3) admin_board.php, (4) admin_disallow.php, (5) admin_forumauth.php, (6) admin_groups.php, (7) admin_ranks.php, (8) admin_styles.php, (9) admin_user_ban.php, (10) admin_words.php, (11) admin_avatar.php, (12) admin_db_utilities.php, (13) admin_forum_prune.php, (14) admin_forums.php, (15) admin_mass_email.php, (16) admin_smilies.php, (17) admin_ug_auth.php, and (18) admin_users.php, which overwrites $phpbb_root_path when the import_request_variables function is executed after $phpbb_root_path has been initialized to a static value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T20:00:00.000Z
CVE-2006-2829 
Buffer overflow in Hawk Monitoring Agent (HMA) for TIBCO Hawk before 4.6.1 and TIBCO Runtime Agent (TRA) before 5.4 allows authenticated users to execute arbitrary code via the configuration for tibhawkhma.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-05T20:00:00.000Z