rainbutterfly/cve_corpus huggingface dataset:
CVE-2007-2688 
The Cisco Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2689 
Check Point Web Intelligence does not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2690 
Multiple IBM ISS Proventia Series products, including the A, G, and M series, do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2691 
MySQL before 4.1.23, 5.0.x before 5.0.42, and 5.1.x before 5.1.18 does not require the DROP privilege for RENAME TABLE statements, which allows remote authenticated users to rename arbitrary tables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2692 
The mysql_change_db function in MySQL 5.0.x before 5.0.40 and 5.1.x before 5.1.18 does not restore THD::db_access privileges when returning from SQL SECURITY INVOKER stored routines, which allows remote authenticated users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2693 
MySQL before 5.1.18 allows remote authenticated users without SELECT privileges to obtain sensitive information from partitioned tables via an ALTER TABLE statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2694 
Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0 GA, and 9.1 GA allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2695 
The HttpClusterServlet and HttpProxyServlet in BEA WebLogic Express and WebLogic Server 6.1 through SP7, 7.0 through SP7, 8.1 through SP5, 9.0, and 9.1, when SecureProxy is enabled, may process "external requests on behalf of a system identity," which allows remote attackers to access administrative data or functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2696 
The JMS Server in BEA WebLogic Server 6.1 through SP7, 7.0 through SP6, and 8.1 through SP5 enforces security access policies on the front end, which allows remote attackers to access protected queues via direct requests to the JMS back-end server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2697 
The embedded LDAP server in BEA WebLogic Express and WebLogic Server 7.0 through SP6, 8.1 through SP5, 9.0, and 9.1, when in certain configurations, does not limit or audit failed authentication attempts, which allows remote attackers to more easily conduct brute-force attacks against the administrator password, or flood the server with login attempts and cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2698 
The Administration Console in BEA WebLogic Server 9.0 may show plaintext Web Service attributes during configuration creation, which allows remote attackers to obtain sensitive credential information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2699 
The Administration Console in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not properly enforce certain Domain Security Policies, which allows remote administrative users in the Deployer role to upload arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2700 
The WLST script generated by the configToScript command in BEA WebLogic Express and WebLogic Server 9.0 and 9.1 does not encrypt certain attributes in configuration files when creating a new domain, which allows remote authenticated users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2701 
The JMS Message Bridge in BEA WebLogic Server 7.0 through SP7 and 8.1 through Service Pack 6, when configured without a username and password, or when the connection URL is not defined, allows remote attackers to bypass the security access policy and "send unauthorized messages to a protected queue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2702 
Cross-site scripting (XSS) vulnerability in the GroupSpace application in BEA WebLogic Portal 9.2 GA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the rich text editor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2703 
BEA WebLogic Portal 9.2 GA can corrupt a visitor entitlements role if an administrator provides a long role description, which might allow remote authenticated users to access privileged resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2704 
BEA WebLogic Server 9.0 through 9.2 allows remote attackers to cause a denial of service (SSL port unavailability) by accessing a half-closed SSL socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2705 
Directory traversal vulnerability in the Test View Console in BEA WebLogic Integration 9.2 before SP1 and WebLogic Workshop 8.1 SP2 through SP6, when "deployed in an exploded format," allows remote attackers to list a WebLogic Workshop Directory (wlwdir) parent directory via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T01:00:00.000Z
CVE-2007-2706 
PHP remote file inclusion vulnerability in maint/ftpmedia.php in Media Gallery 1.4.8a and earlier for Geeklog allows remote attackers to execute arbitrary PHP code via a URL in the _MG_CONF[path_html] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2707 
PHP remote file inclusion vulnerability in linksnet_linkslog_rss.php in Linksnet Newsfeed 1.0 allows remote attackers to execute arbitrary PHP code via a URL in the dirpath_linksnet_newsfeed parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2708 
PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2709 
PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2005 2.00 allows remote attackers to execute arbitrary PHP code via a URL in the SETS[path][physical] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2710 
PHP remote file inclusion vulnerability in functions/prepend_adm.php in NagiosQL 2.00-P00 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the SETS[path][IT] parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2711 
Stack-based buffer overflow in TinyIdentD 2.2 and earlier allows remote attackers to execute arbitrary code via a long string to TCP port 113.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2712 
Unspecified vulnerability in MH Software Connect Daily before 3.3.3 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2713 
ifdate 2.x sends a redirect to the web browser but does not exit when administrative credentials are missing, which allows remote attackers to obtain administrative access via a direct request for the admin/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2714 
Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2715 
Admin/users.php in Snaps! Gallery 1.4.4 allows remote attackers to change arbitrary usernames and passwords via the (1) username, or the (2) password and password2 parameters in an edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T10:00:00.000Z
CVE-2007-2716 
Multiple cross-site scripting (XSS) vulnerabilities in EQdkp 1.3.2c and earlier allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) listmembers.php and (2) stats.php. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T19:00:00.000Z
CVE-2007-2717 
SQL injection vulnerability in shop/page.php in iGeneric (iG) Shop 1.4 allows remote attackers to execute arbitrary SQL commands via the type_id[] parameter, a different vector than CVE-2005-0537.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T19:00:00.000Z
CVE-2007-2718 
Cross-site scripting (XSS) vulnerability in the WebMail system in Stalker CommuniGate Pro 5.1.8 and earlier, when using Microsoft Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via crafted STYLE tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T19:00:00.000Z
CVE-2007-2719 
Session fixation vulnerability in HP Systems Insight Manager (SIM) 4.2 and 5.0 SP4 and SP5 allows remote attackers to hijack web sessions by setting the JSESSIONID cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T19:00:00.000Z
CVE-2007-2720 
Group-Office before 2.16-13 does not properly validate user IDs, which allows remote attackers to obtain sensitive information via certain requests for (1) message.php and (2) messages.php in modules/email/. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T19:00:00.000Z
CVE-2007-2721 
The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files, as originally demonstrated using imagemagick convert.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T20:00:00.000Z
CVE-2007-2722 
Unspecified vulnerability in NewzCrawler 1.8 allows remote attackers to cause a denial of service (application instability) via certain invalid strings in the URL attribute of an ENCLOSURE element, as demonstrated by a "%s" sequence, a "%Y" sequence, a "%%" sequence, and an "n," sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2723 
Media Player Classic 6.4.9.0 allows user-assisted remote attackers to cause a denial of service (web browser crash) via an "empty" .MPA file, which triggers a divide-by-zero error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2724 
Cross-site scripting (XSS) vulnerability in all_photos.html in fotolog allows remote attackers to inject arbitrary web script or HTML via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2725 
The DB Software Laboratory DeWizardX (DEWizardAX.ocx) ActiveX control allows remote attackers to overwrite arbitrary files via the SaveToFile function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2726 
BitsCast 0.13.0 allows remote attackers to cause a denial of service (application crash) via an RSS 2.0 feed item with certain invalid strings in a pubDate element, as demonstrated by repeated "../A" or "A/../" patterns.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2727 
The mcrypt_create_iv function in ext/mcrypt/mcrypt.c in PHP before 4.4.7, 5.2.1, and possibly 5.0.x and other PHP 5 versions, calls php_rand_r with an uninitialized seed variable and therefore always generates the same initialization vector (IV), which might allow context-dependent attackers to decrypt certain data more easily because of the guessable encryption keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2728 
The soap extension in PHP calls php_rand_r with an uninitialized seed variable, which has unknown impact and attack vectors, a related issue to the mcrypt_create_iv issue covered by CVE-2007-2727. Note: The PHP team argue that this is not a valid security issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2729 
Comodo Firewall Pro 2.4.18.184 and Comodo Personal Firewall 2.3.6.81, and probably older Comodo Firewall versions, do not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified identifier that is one, two, or three greater than the canonical identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2730 
Check Point ZoneAlarm Pro before 6.5.737.000 does not properly test for equivalence of process identifiers for certain Microsoft Windows API functions in the NT kernel 5.0 and greater, which allows local users to call these functions, and bypass firewall rules or gain privileges, via a modified identifier that is one, two, or three greater than the canonical identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2731 
CRLF injection vulnerability in formmail.php in Jetbox CMS 2.1 might allow remote attackers to inject arbitrary e-mail headers via LF (%0A) sequences in the subject parameter, a related issue to CVE-2007-1898.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2732 
Multiple cross-site scripting (XSS) vulnerabilities in Jetbox CMS allow remote attackers to inject arbitrary web script or HTML via the (1) path parameter to view/search/; or the (2) companyname, (3) country, (4) email, (5) firstname, (6) middlename, (7) required, (8) surname, or (9) title parameter to view/supplynews/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2733 
Unrestricted file upload vulnerability in Jetbox CMS allows remote authenticated users with author privileges to upload arbitrary scripts via unspecified vectors, which can be accessed in webfiles/.  NOTE: this issue might be a duplicate of CVE-2004-1448.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2734 
The 3Com TippingPoint IPS do not properly handle certain full-width and half-width Unicode character encodings in an HTTP POST request, which might allow remote attackers to evade detection of HTTP traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-16T22:00:00.000Z
CVE-2007-2735 
SQL injection vulnerability in edit_day.php in the ResManager 1.2.1 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the id_reserv parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2736 
PHP remote file inclusion vulnerability in index.php in Achievo 1.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the config_atkroot parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2737 
SQL injection vulnerability in index.php in the MyConference 1.0 module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2738 
SQL injection vulnerability in glossaire-p-f.php in the Glossaire 1.7 and earlier module for Xoops allows remote attackers to execute arbitrary SQL commands via the sid parameter in an ImprDef action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2739 
Cross-site scripting (XSS) vulnerability in xajax before 0.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2740 
Unspecified vulnerability in xajax before 0.2.5 has unknown impact and attack vectors, not related to XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2741 
Stack-based buffer overflow in Little CMS (lcms) before 1.15 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ICC profile in a JPG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2742 
Unrestricted file upload vulnerability in labs.beffa.org w2box 4.0.0 Beta4 allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as .php.jpg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2743 
PHP remote file inclusion vulnerability in custom_vars.php in GlossWord 1.8.1 allows remote attackers to execute arbitrary PHP code via a URL in the sys[path_addon] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2744 
Stack-based buffer overflow in the PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll allows remote attackers to cause a denial of service (Internet Explorer 6 crash), and possibly execute arbitrary code, via a long argument to the SaveBarCode method.  NOTE: this issue might overlap CVE-2007-2657.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T19:00:00.000Z
CVE-2007-2745 
Cross-site scripting (XSS) vulnerability in printcal.pl in vDesk Webmail 4.03 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2746 
The viewList function in lib/WebGUI/Asset/Wobject/DataForm.pm in Plain Black WebGUI before 7.3.14 does not properly use data structures containing privilege information, which allows remote authenticated users to obtain sensitive information or possibly have other unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2747 
Directory traversal vulnerability in rdw_helpers.py in rdiffWeb before 0.3.5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the path parameter to the /browse URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2748 
The substr_count function in PHP 5.2.1 and earlier allows context-dependent attackers to obtain sensitive information via unspecified vectors, a different affected function than CVE-2007-1375.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2749 
SQL injection vulnerability in question.php in FAQEngine 4.16.03 and earlier allows remote attackers to execute arbitrary SQL commands via the questionref parameter in a display action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2750 
SQL injection vulnerability in print.php in SimpNews 2.40.01 and earlier allows remote attackers to execute arbitrary SQL commands via the newsnr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2751 
Multiple PHP remote file inclusion vulnerabilities in PHPGlossar 0.8 allow remote attackers to execute arbitrary PHP code via a URL in the format_menue parameter to (1) admin/inc/change_action.php or (2) admin/inc/add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2752 
SQL injection vulnerability in devami.asp in RunawaySoft Haber portal 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2753 
RunawaySoft Haber portal 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/xice.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T20:00:00.000Z
CVE-2007-2754 
Integer signedness error in truetype/ttgload.c in Freetype 2.3.4 and earlier might allow remote attackers to execute arbitrary code via a crafted TTF image with a negative n_points value, which leads to an integer overflow and heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T22:00:00.000Z
CVE-2007-2755 
The PrecisionID Barcode 1.9 ActiveX control in PrecisionID_Barcode.dll, when Internet Explorer 6 is used, allows remote attackers to overwrite arbitrary files via a full pathname to the SaveToFile function, a different vulnerability than CVE-2007-2744.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-17T23:00:00.000Z
CVE-2007-2756 
The gdPngReadData function in libgd 2.0.34 allows user-assisted attackers to cause a denial of service (CPU consumption) via a crafted PNG image with truncated data, which causes an infinite loop in the png_read_info function in libpng.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2007-05-18T18:00:00.000Z