rainbutterfly/cve_corpus huggingface dataset:
CVE-2004-2570 
Opera before 7.54 allows remote attackers to modify properties and methods of the location object and execute Javascript to read arbitrary files from the client's local filesystem or display a false URL to the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-22T02:00:00.000Z
CVE-2004-2571 
Multiple buffer overflows in EnderUNIX isoqlog 2.1.1 allow remote attackers to execute arbitrary code via the (1) parseQmailFromBytesLine, (2) parseQmailToRemoteLine, (3) parseQmailToLocalLine, (4) parseSendmailFromBytesLine, (5) parseSendmailToLine, (6) parseEximFromBytesLine, and (7) parseEximToLine functions in Parser.c; allow local users to execute arbitrary code via the (8) lowercase and (9) check_syslog_date functions in Parser.c, and (10) unspecified functions in Dir.c; and allow unspecified attackers to execute arbitrary code via the (11) loadconfig and (12) removespaces functions in loadconfig.c, the (13) loadLang function in LangCfg.c, and (14) unspecified functions in Html.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-22T02:00:00.000Z
CVE-2004-2572 
AMAX Magic Winmail Server 3.6 allows remote attackers to obtain sensitive information by entering (1) invalid characters such as "()" or (2) a large number of characters in the Lookup field on the netaddressbook.php web form, which reveals the path in an ldaplib.php error message when the ldap_search function fails, due to improper processing of the $keyword variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-22T02:00:00.000Z
CVE-2004-2573 
PHP remote file inclusion vulnerability in tables_update.inc.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to execute arbitrary PHP code via an external URL in the appdir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2574 
Cross-site scripting (XSS) vulnerability in index.php in phpGroupWare 0.9.14.005 and earlier allows remote attackers to inject arbitrary web script or HTML via the date parameter in a calendar.uicalendar.planner menuaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2575 
phpGroupWare 0.9.14.005 and earlier allow remote attackers to obtain sensitive information via a direct request to (1) hook_admin.inc.php, (2) hook_home.inc.php, (3) class.holidaycalc.inc.php, and (4) setup.inc.php.sample, which reveals the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2576 
class.vfs_dav.inc.php in phpGroupWare 0.9.16.000 does not create .htaccess files to enable authorization checks for access to users' home-directory files, which allows remote attackers to obtain sensitive information from these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2577 
The acl_check function in phpGroupWare 0.9.16RC2 always returns True, even when mkdir does not behave as expected, which could allow remote attackers to obtain sensitive information via WebDAV from users' home directories that lack .htaccess files, and possibly has other unknown impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2578 
phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2579 
ACLCHECK module in Novell iChain 2.3 allows attackers to bypass access control rules of an unspecified component via an unspecified attack vector involving a string that contains escape sequences represented with "overlong UTF-8 encoding."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2580 
Cross-site scripting (XSS) vulnerability in Novell iChain 2.3 allows remote attackers to obtain login credentials via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2581 
Novell iChain 2.3 allows attackers to cause a denial of service via a URL with a "specific string."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2582 
Novell iChain 2.3 includes the build number in the VIA line of the proxy server's HTTP headers, which allows remote attackers to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2583 
SMTP service in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous open connections to TCP port 25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2584 
frmAddfolder.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote authenticated users to create a folder that SmarterMail cannot delete or rename via a folder name with a null byte ("%00"). NOTE: it is not clear whether this issue poses a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2585 
Cross-site scripting (XSS) vulnerability in frmCompose.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to inject arbitrary web script or HTML via Javascript to the "check spelling" feature in the compose area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2586 
Directory traversal vulnerability in frmGetAttachment.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to read arbitrary files via the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2587 
login.aspx in SmarterTools SmarterMail 1.6.1511 and 1.6.1529 allows remote attackers to cause a denial of service via a long txtusername parameter, possibly due to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2588 
Intentional information leak in phpinfo.php in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allows remote attackers to obtain sensitive information such as the configuration of the web server and the PHP application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2589 
Gaim before 0.82 allows remote servers to cause a denial of service (application crash) via a long HTTP Content-Length header, which causes Gaim to abort when attempting to allocate memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2590 
Unspecified vulnerability in meindlSOFT Cute PHP Library (aka cphplib) 0.46 has unknown impact and attack vectors, related to regular expressions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-28T23:00:00.000Z
CVE-2004-2591 
The data-overwrite capability of ButtUglySoftware CleanCache 2.19 does not properly overwrite data in files, which allows attackers to recover the data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2592 
Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (application crash) via a modified client that asks the server to send data stored at a negative array offset, which is not handled when processing Configstrings and Baselines.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2593 
Buffer overflow in command-packet processing of Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a packet with a long cmd_args buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2594 
Absolute path traversal vulnerability in Quake II server before R1Q2 on Windows, as used in multiple products, allows remote attackers to read arbitrary files via a "\/" in a pathname argument, as demonstrated by "download \/server.cfg".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2595 
Absolute path traversal vulnerability in Quake II server before R1Q2 on Linux, as used in multiple products, allows remote attackers to cause a denial of service (application crash) via a download command with a full pathname for a directory in the argument, which causes the server to crash when it cannot read data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2596 
Quake II server before R1Q2, as used in multiple products, allows remote attackers to cause a denial of service (exhaustion of connection slots) via a large number of connections from the same IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2597 
Quake II server before R1Q2, as used in multiple products, allows remote attackers to bypass IP-based access control rules via a userinfo string that already contains an "ip" key/value pair but is also long enough to cause a new key/value pair to be truncated, which interferes with the server's ability to find the client's IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2598 
Quake II server before R1Q2, as used in multiple products, allows remote attackers to corrupt the server's client state data structure by exiting a session without a valid disconnect command, then reconnecting, which prevents a mod from being notified of changes in the client state.  NOTE: the impact of this issue will vary depending on which mod is being used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2599 
Multiple buffer overflows in Quake II server before R1Q2, as used in multiple products, allow local users to cause a denial of service (application crash) via the server console or rcon.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2600 
The firmware for Intelligent Platform Management Interface (IPMI) 1.5-based Intel Server Boards and Platforms is shipped with an Authentication Type Enables parameter set to an invalid None parameter, which allows remote attackers to obtain sensitive information when LAN management functionality is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2601 
PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) allows remote attackers to read local files and possibly execute PHP code via a URL in the SKIN_inner parameter to inc/skin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2602 
PHP remote file inclusion vulnerability in UberTec Help Center Live (HCL) before 1.2.7 allows remote attackers to execute arbitrary PHP code via a URL in the HCL_path parameter to pipe.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2603 
Cross-site scripting (XSS) vulnerability in the Search module in UberTec Help Center Live (HCL) allows remote attackers to inject arbitrary web script or HTML via the find parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2604 
Cross-site scripting (XSS) vulnerability in index.php in PHProxy allows remote attackers to inject arbitrary web script or HTML via the error parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2605 
aStats 1.6.5 allows local users to overwrite arbitrary files via a symlink attack on (1) the aStats-Graphic-Signature-Generation file and (2) certain PNG image files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2606 
The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt to login to an administration web page, even when the configuration specifies that remote administration is disabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-11-29T02:00:00.000Z
CVE-2004-2607 
A numeric casting discrepancy in sdla_xfer in Linux kernel 2.6.x up to 2.6.5 and 2.4 up to 2.4.29-rc1 allows local users to read portions of kernel memory via a large len argument, which is received as an int but cast to a short, which prevents a read loop from filling a buffer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-03T00:00:00.000Z
CVE-2004-2608 
SmartWebby Smart Guest Book stores SmartGuestBook.mdb (aka the "news database") under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as the unencrypted username and password of the administrator's account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2609 
The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencrypted password for a Windows domain account) via four "stuffit /f:stuffit.dat" invocations, possibly due to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2610 
mntd_mount.c in mntd before 0.4.2 might allow local users to gain privileges via shell metacharacters in a remount option in the configuration file.  NOTE: It is not clear whether this is a vulnerability because there is not necessarily any common usage in which privilege boundaries are crossed.  Typical usage would restrict write access to the configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2611 
The Change Permissions function in the Sophster suite before 0.9.6 28 May 2004 (aka 0.9.6-r5), possibly including Sophster, FreeSophster, and FreeSophsterPAM, removes the (1) setuid, (2) setgid, and (3) sticky bits when changing a file, which might allow attackers to gain privileges or conduct other unauthorized activities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2612 
BNC 2.9.0 only grants access when an incorrect password is provided, which allows remote attackers to use the functionality intended for authorized users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2613 
Unspecified vulnerability in procfs in the Linux-VServer stable branch for the 2.4 kernel before 1.23 and Linux-VServer development branch for the 2.4 kernel before 1.3.5 has unspecified impact and attack vectors, related to "write access to specific proc entries from a vserver context", a different vulnerability than CVE-2004-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2614 
Buffer overflow in MyWeb 3.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2615 
The documentation for CuteNews 1.3.6 and possibly other versions specifies that files under cutenews/data must be manually given world-writable permissions, which allows local users to insert false news, delete news, and possibly gain privileges or have other unknown impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2616 
The file server in ActivePost Standard 3.1 and earlier allows remote authenticated users to obtain sensitive information by uploading a file, which reveals the path in a success message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2617 
Directory traversal vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to read files outside of the web root via a .. (dot dot) directly after the initial '/' (slash) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2618 
Cross-site scripting (XSS) vulnerability in Pegasi Web Server (PWS) 0.2.2 allows remote attackers to inject arbitrary web script or HTML via the URI, directly after the initial '/' (slash).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T11:00:00.000Z
CVE-2004-2619 
ripMIME 1.3.2.3 and earlier allows remote attackers to bypass e-mail protection via a base64 MIME encoded attachment containing invalid characters that are not properly extracted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2620 
The MIMEH_read_headers function in ripMIME 1.3.1.0 does not properly handle trailing "\r" and "\n" characters in headers, which leads to a buffer underflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2621 
Nortel Contivity VPN Client 2.1.7, 3.00, 3.01, 4.91, and 5.01, when opening a VPN tunnel, does not check the gateway certificate until after a dialog box has been displayed to the user, which creates a race condition that allows remote attackers to perform a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2622 
AClient.exe in Altiris Deployment Solution 6.x and 5.x does not require authentication from the first Deployment Server that it connects to, which allows remote malicious servers to gain administrator access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2623 
Unknown vulnerability in Rippy the Aggregator before 0.10, when register_globals is enabled, has unknown attack vectors and impact, possibly related to the "user-controlled filter."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2624 
Cross-site scripting (XSS) vulnerability in "TextSearch" in WackoWiki 3.5 allows remote attackers to inject arbitrary web script or HTML via the "phrase" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2625 
Cross-site scripting (XSS) vulnerability in Outblaze Email allows remote attackers to inject arbitrary web script or HTML via Javascript in an attribute of an IMG tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2626 
GUI overlay vulnerability in the Java API in Siemens S55 cellular phones allows remote attackers to send unauthorized SMS messages by overlaying a confirmation message with a malicious message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2627 
Java 2 Micro Edition (J2ME) does not properly validate bytecode, which allows remote attackers to escape the Kilobyte Virtual Machine (KVM) sandbox and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2628 
Multiple directory traversal vulnerabilities in thttpd 2.07 beta 0.4, when running on Windows, allow remote attackers to read arbitrary files via a URL that contains (1) a hex-encoded backslash dot-dot sequence ("%5C..") or (2) a drive letter (such as "C:").
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2629 
Multiple vulnerabilities in the H.323 protocol implementation for First Virtual Communications Click to Meet Express (when used with H.323 conferencing endpoints), Click to Meet Premier, Conference Server, and V-Gate allow remote attackers to cause a denial of service, as demonstrated by the NISCC/OUSPG PROTOS test suite for the H.225 protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2630 
The MIME transformation system (transformations/text_plain__external.inc.php) in phpMyAdmin 2.5.0 up to 2.6.0-pl1 allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2631 
Eval injection vulnerability in left.php in phpMyAdmin 2.5.1 up to 2.5.7, when LeftFrameLight is FALSE, allows remote attackers to execute arbitrary PHP code via a crafted table name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2632 
phpMyAdmin 2.5.1 up to 2.5.7 allows remote attackers to modify configuration settings and gain unauthorized access to MySQL servers via modified $cfg['Servers'] variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2633 
Unspecified vulnerability in Sesamie 1.0 allows remote anonymous attackers to gain access to repositories of other users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2634 
The (1) bos.rte.serv_aid or (2) bos.rte.console filesets in IBM AIX 5.1 and 5.2 allow local users to overwrite arbitrary files via a symlink attack on temporary files via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2635 
An ActiveX control for McAfee Security Installer Control System 4.0.0.81 allows remote attackers to access the Windows registry via web pages that use the control's RegQueryValue() method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2636 
TinyWeb 1.9 allows remote attackers to read source code of scripts via "/./" in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2637 
The NAT implementation in Zonet ZSR1104WE Wireless Router Runtime Code Version 2.41 converts IP addresses of inbound connections to the IP address of the router, which allows remote attackers to bypass intended security restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z
CVE-2004-2638 
The Admin Access With Levels plugin in osCommerce 1.5.1 allows remote attackers to access files in the "admin/" directory by modifying the in_login parameter to a non-zero value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-12-04T22:00:00.000Z