rainbutterfly/cve_corpus huggingface dataset:
CVE-2006-3277 
The SMTP service of MailEnable Standard 1.92 and earlier, Professional 2.0 and earlier, and Enterprise 2.0 and earlier before the MESMTPC hotfix, allows remote attackers to cause a denial of service (application crash) via a HELO command with a null byte in the argument, possibly triggering a length inconsistency or a missing argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3278 
Cross-site scripting (XSS) vulnerability in H-Sphere 2.5.1 Beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) next_template, (2) start, (3) curr_menu_id, and (4) arid parameters in psoft/servlet/resadmin/psoft.hsphere.CP when using the mailman/massmail.html template_name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3279 
Cross-site scripting (XSS) vulnerability in aeDating 4.1 allows remote attackers to inject arbitrary web script or HTML via the (1) Sex parameter in index.php, (2) ProfileType parameter in join_form.php, and (3) Email parameter in forgot.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3280 
Cross-domain vulnerability in Microsoft Internet Explorer 6.0 allows remote attackers to access restricted information from other domains via an object tag with a data parameter that references a link on the attacker's originating site that specifies a Location HTTP header that references the target site, which then makes that content available through the outerHTML attribute of the object, aka "Redirect Cross-Domain Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3281 
Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events, which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\ (%2e%2e%5c) sequences and whose extension contains the CLSID Key identifier for HTML Applications (HTA), aka "Folder GUID Code Execution Vulnerability."  NOTE: directory traversal sequences were used in the original exploit, although their role is not clear.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3282 
requirements.php in Dating Agent PRO 4.7.1 allows remote attackers to obtain sensitive information via a direct request, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3283 
SQL injection vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to execute arbitrary SQL commands via the (1) pid parameter in picture.php, (2) mid parameter in mem.php, and the (3) sex and (4) relationship parameters in search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3284 
Cross-site scripting (XSS) vulnerability in Dating Agent PRO 4.7.1 allows remote attackers to inject arbitrary web script or HTML via the login parameter in (1) webmaster/index.php and (2) search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3285 
The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) uses an undocumented, hard-coded username and password, which allows remote authenticated users to read, and possibly modify, sensitive configuration data (aka bugs CSCsd15955).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T22:00:00.000Z
CVE-2006-3286 
The internal database in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(63) stores a hard-coded username and password in plaintext within unspecified files, which allows remote authenticated users to access the database (aka bug CSCsd15951).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T23:00:00.000Z
CVE-2006-3287 
Cisco Wireless Control System (WCS) for Linux and Windows 4.0(1) and earlier uses a default administrator username "root" and password "public," which allows remote attackers to gain access (aka bug CSCse21391).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T23:00:00.000Z
CVE-2006-3288 
Unspecified vulnerability in the TFTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51), when configured to use a directory path name that contains a space character, allows remote authenticated users to read and overwrite arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T23:00:00.000Z
CVE-2006-3289 
Cross-site scripting (XSS) vulnerability in the login page of the HTTP interface for the Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving a "malicious URL".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T23:00:00.000Z
CVE-2006-3290 
HTTP server in Cisco Wireless Control System (WCS) for Linux and Windows before 3.2(51) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames and directory paths via a direct URL request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T23:00:00.000Z
CVE-2006-3291 
The web interface on Cisco IOS 12.3(8)JA and 12.3(8)JA1, as used on the Cisco Wireless Access Point and Wireless Bridge, reconfigures itself when it is changed to use the "Local User List Only (Individual Passwords)" setting, which removes all security and password configurations and allows remote attackers to access the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T23:00:00.000Z
CVE-2006-3292 
SQL injection vulnerability in the Search gadget in Jaws 0.6.2 allows remote attackers to execute arbitrary SQL commands via queries with the "LIKE" keyword in the searchdata parameter (search field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-28T23:00:00.000Z
CVE-2006-3293 
parse_notice (TiCPU) in EnergyMech (emech) before 3.0.2 allows remote attackers to cause a denial of service (crash) via empty IRC CTCP NOTICE messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3294 
PHP remote file inclusion vulnerability in mod_cbsms_messages.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3295 
Cross-site scripting (XSS) vulnerability in header.php in Open Guestbook 0.5 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3296 
SQL injection vulnerability in view.php in Open Guestbook 0.5 allows remote attackers to execute arbitrary SQL commands via the offset parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3297 
Cross-site scripting (XSS) vulnerability in error.php in UebiMiau Webmail 2.7.10 and earlier allows remote attackers to inject arbitrary web script or HTML via the icq parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3298 
Yahoo! Messenger 7.5.0.814 and 7.0.438 allows remote attackers to cause a denial of service (crash) via messages that contain non-ASCII characters, which triggers the crash in jscript.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3299 
Cross-site scripting (XSS) vulnerability in index.php in Usenet Script 0.5 allows remote attackers to inject arbitrary web script or HTML via the group parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3300 
PHP remote file inclusion vulnerability in sms_config/gateway.php in PhpMySms 2.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the ROOT_PATH parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3301 
Multiple cross-site scripting (XSS) vulnerabilities in phpQLAdmin 2.2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the domain parameter in (1) user_add.php or (2) unit_add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3302 
PHP remote file inclusion vulnerability in mod_cbsms.php in CBSMS Mambo Module 1.0 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosC_a_path parameter.  NOTE: the provenance of this information is unknown; portions of the details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3303 
Multiple cross-site scripting (XSS) vulnerabilities in pm.php in DeluxeBB 1.07 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) subject or (2) to parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3304 
SQL injection vulnerability in cp.php in DeluxeBB 1.07 and earlier allows remote attackers to execute arbitrary SQL commands via the xmsn parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3305 
Multiple cross-site scripting (XSS) vulnerabilities in UebiMiau Webmail 2.7.10, and 2.7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) f_user parameter in index.php, the (2) pag parameter in messages.php, or the (3) lid, (4) tid, and (5) sid parameters in error.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3306 
Cross-site scripting (XSS) vulnerability in the preparestring function in lib/common.php in Project EROS bbsengine before 20060501-0142-jam, and possibly earlier versions dating back to 2006-02-23, might allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3307 
Multiple SQL injection vulnerabilities in Project EROS bbsengine before bbsengine-20060429-1550-jam allow remote attackers to execute arbitrary SQL commands via (1) unspecified parameters in the php/comment.php and (2) the getpartialmatches method in php/aolbonics.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3308 
Unspecified vulnerability in the wpprop code for Project EROS bbsengine before 20060622-0315 has unknown impact and remote attack vectors via [img] tags, possibly cross-site scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3309 
SQL injection vulnerability in SPT--ForumTopics.php in Scout Portal Toolkit (SPT) 1.4.0 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T01:00:00.000Z
CVE-2006-3311 
Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-09-12T23:00:00.000Z
CVE-2006-3312 
Multiple cross-site scripting (XSS) vulnerabilities in ashmans and Bill Echlin QaTraq 6.5 RC and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) link_print, (2) link_upgrade, (3) link_sql, (4) link_next, (5) link_prev, and (6) link_list parameters in top.inc as included by queries_view_search.php; the (7) msg, (8) component_name, and (9) component_desc parameters in (a) components_copy_content.php, (b) components_modify_content.php, and (c) components_new_content.php; the (10) title, (11) version, and (12) content parameters in design_copy_content.php; the (13) plan_title and (14) plan_content parameters in design_copy_plan_search.php; the (15) title, (16) minor_version, (17) new_version, and (18) content parameters in design_modify_content.php; the (19) title, (20) version, and (21) content parameters in design_new_content.php; the (22) plan_name and (23) plan_desc parameters in design_new_search.php; the (24) file_name parameter in download.php; the (25) username and (26) password parameters in login.php; the (27) title, (28) version, and (29) content parameters in phase_copy_content.php; the (30) content parameter in phase_delete_search.php; the (31) title, (32) minor_version, (33) new_version, and (34) content parameters in phase_modify_content.php; the (35) content, (36) title, (37) version, and (38) content parameters in phase_modify_search.php; the (39) content parameter in phase_view_search.php; the (40) msg, (41) product_name, and (42) product_desc parameters in products_copy_content.php; and possibly the (43) product_name and (44) product_desc parameters in (d) products_copy_search.php, and a large number of additional parameters and executables.  NOTE: the vendor notified CVE via e-mail that this issue has been fixed in the 6.8 RC release.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T19:00:00.000Z
CVE-2006-3313 
Cross-site scripting (XSS) vulnerability in search.jsp in Netsoft smartNet 2.0 allows remote attackers to inject arbitrary web script or HTML via the keyWord parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T19:00:00.000Z
CVE-2006-3314 
PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the pageid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T19:00:00.000Z
CVE-2006-3315 
PHP remote file inclusion vulnerability in page.php in an unspecified RahnemaCo.com product, possibly eShop, allows remote attackers to execute arbitrary PHP code via a URL in the osCsid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T19:00:00.000Z
CVE-2006-3316 
Multiple PHP remote file inclusion vulnerabilities in phpRaid 3.0.5 allow remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) logs.php and (2) users.php, a different set of vectors than CVE-2006-3116.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T21:00:00.000Z
CVE-2006-3317 
PHP remote file inclusion vulnerability in phpRaid 3.0.6 allows remote attackers to execute arbitrary code via a URL in the phpraid_dir parameter to (1) announcements.php and (2) rss.php, a different set of vectors and affected versions than CVE-2006-3316 and CVE-2006-3116.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T21:00:00.000Z
CVE-2006-3318 
SQL injection vulnerability in register.php for phpRaid 3.0.6 and possibly other versions, when the authorization type is phpraid, allows remote attackers to execute arbitrary SQL commands via the (1) username and (2) email parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-29T21:00:00.000Z
CVE-2006-3319 
Cross-site scripting (XSS) vulnerability in rss/index.php in PHP iCalendar 2.22 and earlier allows remote attackers to inject arbitrary web script or HTML via the cal parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T01:00:00.000Z
CVE-2006-3320 
Cross-site scripting (XSS) vulnerability in command.php in SiteBar 3.3.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the command parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T01:00:00.000Z
CVE-2006-3321 
Multiple cross-site scripting (XSS) vulnerabilities in openforum.asp in OpenForum 1.2 Beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) ofdisp and (2) ofmsgid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T10:00:00.000Z
CVE-2006-3322 
SQL injection vulnerability in includes/functions_logging.php in phpRaid 3.0.5, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the log_hack function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T20:00:00.000Z
CVE-2006-3323 
PHP remote file inclusion vulnerability in admin/admin.php in MF Piadas 1.0 allows remote attackers to execute arbitrary PHP code via the page parameter.  NOTE: the same vector can be used for cross-site scripting, but CVE analysis suggests that this is resultant from file inclusion of HTML or script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3324 
The Automatic Downloading option in the id3 Quake 3 Engine and the Icculus Quake 3 Engine (ioquake3) before revision 804 allows remote attackers to overwrite arbitrary files in the quake3 directory (fs_homepath cvar) via a long string of filenames, as contained in the neededpaks buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3325 
client/cl_parse.c in the id3 Quake 3 Engine 1.32c and the Icculus Quake 3 Engine (ioquake3) revision 810 and earlier allows remote malicious servers to overwrite arbitrary write-protected cvars variables on the client, such as cl_allowdownload for Automatic Downloading and fs_homepath for the quake3 path, via a string of cvar names and values sent from the server.  NOTE: this can be combined with another vulnerability to overwrite arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3326 
Directory traversal vulnerability in QuickZip 3.06.3 allows remote user-assisted attackers to overwrite arbitrary files or directories via .. (dot dot) sequences in filenames within (1) TAR,(2) GZ, and (3) JAR archives.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3327 
Cross-site scripting (XSS) vulnerability in Custom dating biz dating script 1.0 allows remote attackers to inject arbitrary web script or HTML via the (1) sn20_special_cases parameter ("Special Cases" field) in profile/mini.php, (2) tyxx01_album_name parameter ("Album Name" field) in profile/photo_create.php, and the (3) u parameter in admin/user_view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3328 
new_ticket.cgi in Hostflow 2.2.1-15 allows remote attackers to steal and replay authentication credentials via an IMG tag in the desc parameter ("Ticket Description" field) that points to a URL that captures referer URLs, possibly due to a cross-site scripting (XSS) vulnerability or a leak of credentials in referer URLs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3329 
SQL injection vulnerability in search.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the rate parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3330 
Cross-site scripting (XSS) vulnerability in AddAsset1.php in PHP/MySQL Classifieds (PHP Classifieds) allows remote attackers to execute arbitrary SQL commands via the (1) ProductName ("Title" field), (2) url, and (3) Description parameters, possibly related to issues in add1.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3331 
Opera before 9.0 does not reset the SSL security bar after displaying a download dialog from an SSL-enabled website, which allows remote attackers to spoof a trusted SSL certificate from an untrusted website and facilitates phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3332 
SQL injection vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to execute arbitrary SQL commands via the (1) offset, (2) tid, (3) fromid, (4) sortby, (5) fromfrommethod, and (6) fromfromlist parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3333 
Cross-site scripting (XSS) vulnerability in index.php in Zorum Forum 3.5 allows remote attackers to inject web script or HTML via the multiple unspecified parameters, including the (1) frommethod, (2) list, and (3) method, which are reflected in an error message.  NOTE: some of these vectors might be resultant from SQL injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3334 
Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng before 1.2.12 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors related to "chunk error processing," possibly involving the "chunk_name".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-06-30T23:00:00.000Z
CVE-2006-3335 
Unspecified vulnerability in mkdir in HP-UX B.11.00, B.11.04, B.11.11, and B.11.23 allows local users to gain privileges via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T01:00:00.000Z
CVE-2006-3336 
TWiki 01-Dec-2000 up to 4.0.3 allows remote attackers to bypass the upload filter and execute arbitrary code via filenames with double extensions such as ".php.en", ".php.1", and other allowed extensions that are not .txt.  NOTE: this is only a vulnerability when the server allows script execution in the pub directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-05T20:00:00.000Z
CVE-2006-3337 
Cross-site scripting (XSS) vulnerability in frontend/x/files/select.html in cPanel 10.8.2-CURRENT 118 and earlier allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2006-07-03T18:00:00.000Z