rainbutterfly/cve_corpus huggingface dataset:
CVE-2005-2361 
Unknown vulnerability in the (1) AgentX dissector, (2) PER dissector, (3) DOCSIS dissector, (4) SCTP graphs, (5) HTTP dissector, (6) DCERPC, (7) DHCP, (8) RADIUS dissector, (9) Telnet dissector, (10) IS-IS LSP dissector, or (11) NCP dissector in Ethereal 0.8.19 through 0.10.11 allows remote attackers to cause a denial of service (application crash or abort) via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2362 
Unknown vulnerability several dissectors in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a denial of service (application crash) by reassembling certain packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2363 
Unknown vulnerability in the (1) SMPP dissector, (2) 802.3 dissector, (3) DHCP, (4) MEGACO dissector, or (5) H1 dissector in Ethereal 0.8.15 through 0.10.11 allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2364 
Unknown vulnerability in the (1) GIOP dissector, (2) WBXML, or (3) CAMEL dissector in Ethereal 0.8.20 through 0.10.11 allows remote attackers to cause a denial of service (application crash) via certain packets that cause a null pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2365 
Unknown vulnerability in the SMB dissector in Ethereal 0.9.0 through 0.10.11 allows remote attackers to cause a buffer overflow or a denial of service (memory consumption) via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2366 
Unknown vulnerability in the BER dissector in Ethereal 0.10.11 allows remote attackers to cause a denial of service (abort or infinite loop) via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2367 
Format string vulnerability in the proto_item_set_text function in Ethereal 0.9.4 through 0.10.11, as used in multiple dissectors, allows remote attackers to write to arbitrary memory locations and gain privileges via a crafted AFP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-10T04:00:00.000Z
CVE-2005-2368 
vim 6.3 before 6.3.082, with modelines enabled, allows external user-assisted attackers to execute arbitrary commands via shell metacharacters in the (1) glob or (2) expand commands of a foldexpr expression for calculating fold levels.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2369 
Multiple integer signedness errors in libgadu, as used in ekg before 1.6rc2 and other packages, may allow remote attackers to cause a denial of service or execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2370 
Multiple "memory alignment errors" in libgadu, as used in ekg before 1.6rc2, Gaim before 1.5.0, and other packages, allows remote attackers to cause a denial of service (bus error) on certain architectures such as SPARC via an incoming message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2371 
Directory traversal vulnerability in Oracle Reports 6.0, 6i, 9i, and 10g allows remote attackers to overwrite arbitrary files via (1) "..", (2) Windows drive letter (C:), and (3) absolute path sequences in the desname parameter.  NOTE: this issue was probably fixed by REP06 in CPU Jan 2006, in which case it overlaps CVE-2006-0289.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2372 
Oracle Forms 4.5 through 10g starts form executables from arbitrary directories and executes them as the Oracle or System user, which allows attackers to execute arbitrary code by uploading a malicious .fmx file and referencing it using an absolute pathname argument in the (1) form or (2) module parameters to f90servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2373 
Buffer overflow in SlimFTPd 3.15 and 3.16 allows remote authenticated users to execute arbitrary code via a long directory name to (1) LIST, (2) DELE or (3) RNFR commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2374 
Belkin 54g wireless routers do not properly set an administrative password, which allows remote attackers to gain access via the (1) Telnet or (2) web administration interfaces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2375 
Format string vulnerability in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via format string specifiers in a (1) nickname or (2) chat message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2376 
Buffer overflow in Race Driver 1.20 and earlier allows remote attackers to cause a denial of service (application crash) via a long (1) nickname or (2) chat message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2377 
nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service (crond and other application crash) if they can cause an LDAP server to become unavailable.  NOTE: it is not clear whether this attack scenario is sufficient to include this item in CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2378 
Directory traversal vulnerability in Oracle Reports allows remote attackers to read arbitrary files via an absolute or relative path to the (1) CUSTOMIZE or (2) desformat parameters to rwservlet.  NOTE: vector 2 is probably the same as CVE-2006-0289, and fixed in Jan 2006 CPU.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2379 
Multiple cross-site scripting (XSS) vulnerabilities in Oracle Reports 9.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) debug parameter to showenv, (2) test parameter to parsequery, or (3) delimiter or (4) CELLWRAPPER parameter to rwservlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2380 
Multiple cross-site scripting vulnerabilities in PHP Surveyor 0.98 allow remote attackers to inject arbitrary web script or HTML via the (1) sid, (2) start, and (3) id parameters to browse.php, or the sid parameter to (4) dataentry.php or (5) export.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2381 
PHP Surveyor 0.98 allows remote attackers to obtain sensitive information via a direct request to (1) question.php, (2) survey.php, or (3) group.php in the root directory, a direct request to (4) database.php, (5) sessioncontrol.php, (6) html.php, (7) sessioncontrol.php, an invalid (8) qid parameter to dumpquestion.php, or an invalid lid parameter to (9) labels.php or (10) dumplabel.php, which reveal the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2382 
Oray PeanutHull 3.0.1.0 and earlier does not properly drop SYSTEM privileges when launched from the system tray, which allows local users to gain privileges by accessing the Help functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2383 
SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-26T04:00:00.000Z
CVE-2005-2384 
Directory traversal vulnerability in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460, allows remote attackers to write arbitrary files via an ACE archive containing filenames with (1) .. or (2) absolute pathnames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2385 
Buffer overflow in a third-party compression library (UNACEV2.DLL), as used in avast! Antivirus Home/Professional Edition 4.6.665 and Server Edition 4.6.460, allows remote attackers to execute arbitrary code via an ACE archive containing a long filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2386 
Cross-site scripting (XSS) vulnerability in viewCart.asp in CartWIZ 1.20 allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2387 
Multiple stack-based buffer overflows in GoodTech SMTP server 5.16 allow remote attackers to execute arbitrary code via (1) a RCPT TO command with a long DNS name, or (2) a large number of RCPT TO commands with a long e-mail name arugment in the last command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2388 
Buffer overflow in a certain USB driver, as used on Microsoft Windows, allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2389 
NDMP server in Veritas NetBackup 5.1 allows attackers to cause a denial of service via a CONFIG message with an out-of-range timestamp, which triggers a null dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2390 
Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut, or (2) the SQLShowInfo mod_sql directive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2391 
Unknown vulnerability in 3Com OfficeConnect Wireless 11g Access Point before 1.03.12 allows remote attackers to obtain sensitive information via the web interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2392 
Cross-site scripting (XSS) vulnerability in index.php for CMSimple 2.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in the search function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2393 
Cross-site scripting (XSS) vulnerability in CuteNews 1.3.6 allows remote attackers to inject arbitrary web script or HTML via (1) the lastusername parameter to index.php or (2) selected_search_arch parameter to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2394 
show_news.php in CuteNews 1.3.6 allows remote attackers to obtain the full path of the server via an invalid archive parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2395 
Mozilla Firefox 1.0.4 and 1.0.5 does not choose the challenge with the strongest authentication scheme available as required by RFC2617, which might cause credentials to be sent in plaintext even if an encrypted channel is available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2396 
Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2397 
Cross-site scripting (XSS) vulnerability in guestbook.php in phpBook 1.46 allows remote attackers to inject arbitrary web script or HTML via the admin parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2398 
Multiple SQL injection vulnerabilities in PHP Surveyor 0.98 allows remote attackers to execute arbitrary SQL commands via (1) the sid, start, and id parameters to browse.php, the sid parameter to (2) dataentry.php, (3) export.php, (4) admin.php, (5) conditions.php, (6) spss.php, (7) deletesurvey.php, (8) dumpsurvey.php, or (9) statistics.php, or the lid parameter to (10) labels.php or (11) dumplabel.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2399 
PHP Surveyor 0.98 allows remote attackers to trigger SQL errors via missing parameters to (1) browse.php, (2) export.php, (3) conditions.php, or (4) spss.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2400 
The inc.login.php scripts in PHPFinance 0.3 allows remote attackers to bypass the login and gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2401 
PHP-Fusion allows remote attackers to inject arbitrary Cascading Style Sheets (CSS) via the BBCode color tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2402 
Cross-site scripting (XSS) vulnerability in search.php in PHPSiteSearch 1.7.7d allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2403 
The login protocol in RealChat 3.5.1b does not use authentication, which allows remote attackers to log on as other users by sniffing the beginning of a chat session and replaying it via a modified username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2404 
SQL injection vulnerability in sendcard.php in Sendcard 3.2.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-27T04:00:00.000Z
CVE-2005-2405 
Opera 8.01, when the "Arial Unicode MS" font (ARIALUNI.TTF) is installed, does not properly handle extended ASCII characters in the file download dialog box, which allows remote attackers to spoof file extensions and possibly trick users into executing arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-28T04:00:00.000Z
CVE-2005-2406 
Opera 8.01 allows remote attackers to conduct cross-site scripting (XSS) attacks or modify which files are uploaded by tricking a user into dragging an image that is a "javascript:" URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-28T04:00:00.000Z
CVE-2005-2407 
A design error in Opera 8.01 and earlier allows user-assisted attackers to execute arbitrary code by overlaying a malicious new window above a file download dialog box, then tricking the user into double-clicking on the "Run" button, aka "link hijacking".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-07-28T04:00:00.000Z
CVE-2005-2409 
Format string vulnerability in util.c in nbsmtp 0.99 and earlier, while running in debug mode, allows remote attackers to execute arbitrary code via format string specifiers that are not properly handled in a syslog call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-01T04:00:00.000Z
CVE-2005-2410 
Format string vulnerability in the nm_info_handler function in Network Manager may allow remote attackers to execute arbitrary code via format string specifiers in a Wireless Access Point identifier, which is not properly handled in a syslog call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-01T04:00:00.000Z
CVE-2005-2411 
Cross-Site Request Forgery (CSRF) vulnerability in tDiary 2.1.1, and tDiary 2.0.1 and earlier, allows remote attackers to conduct actions as another user, and execute commands on the server, via a URL that is activated by the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-01T04:00:00.000Z
CVE-2005-2412 
PHP remote file inclusion vulnerability in block.php in PHP FirstPost allows remote attackers to execute arbitrary PHP code via the Include parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2413 
PHP remote file inclusion vulnerability in apa_phpinclude.inc.php in Atomic Photo Album (APA) allows remote attackers to execute arbitrary PHP code via the apa_module_basedir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2414 
Race condition in the xpcom library, as used by web browsers such as Firefox, Mozilla, Netscape, and Galeon, allows remote attackers to cause a denial of service (application crash) via a large HTML file that loads a DOM call from within nested DIV tags, which causes part of the currently rendering page and referenced objects to be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2415 
Multiple SQL injection vulnerabilities in Contrexx before 1.0.5 allow remote attackers to execute arbitrary SQL commands via the (1) value parameter to the poll module or (2) pId parameter to the gallery module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2416 
Multiple cross-site scripting (XSS) vulnerabilities in Contrexx before 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) term parameter to the search module or (2) title in the blog aggregation module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2417 
Contrexx before 1.0.5 allows remote attackers to obtain sensitive information via a direct request to /config/version.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2419 
B-FOCuS Router 312+ allows remote attackers to bypass authentication and gain unauthorized access via a direct request to firmwarecfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2420 
flsearch.pl in FtpLocate 2.02 allows remote attackers to execute arbitrary commands via shell metacharacters in an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2421 
Multiple SQL injection vulnerabilities in index.php and other pages in Beehive Forum allow remote attackers to execute arbitrary SQL commands via the webtag parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2422 
Cross-site scripting (XSS) vulnerability in index.php in Beehive Forum allows remote attackers to inject arbitrary web script or HTML via the webtag parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2423 
Beehive Forum allows remote attackers to obtain sensitive information via (1) an invalid final_uri or sort_by parameter to index.php or a direct request to (2) admin.php, (3) attachments.inc.php, (4) banned.inc.php, (5) beehive.inc.php, (6) constants.inc.php, (7) db.inc.php, (8) dictionary.inc.php or (9) search_index.php, which reveal the path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2424 
The management interface for Siemens SANTIS 50 running firmware 4.2.8.0, and possibly other products including Ericsson HN294dp and Dynalink RTA300W, allows remote attackers to access the Telnet port without authentication via certain packets to the web interface that cause the interface to freeze.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2425 
Stack-based buffer overflow in Ares FileShare 1.1 allows remote attackers or local users to execute arbitrary code via a (1) long history parameter in the configuration file (ares.conf) or (2) long search string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2426 
FTPshell Server 3.38 allows remote authenticated users to cause a denial of service (application crash) by multiple connections and disconnections without using the QUIT command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2427 
Cross-site scripting (XSS) vulnerability in viewCart.asp in CartWIZ allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2428 
Lotus Domino R5 and R6 WebMail, with "Generate HTML for all fields" enabled, stores sensitive data from names.nsf in hidden form fields, which allows remote attackers to read the HTML source to obtain sensitive information such as (1) the password hash in the HTTPPassword field, (2) the password change date in the HTTPPasswordChangeDate field, (3) the client platform in the ClntPltfrm field, (4) the client machine name in the ClntMachine field, and (5) the client Lotus Domino release in the ClntBld field, a different vulnerability than CVE-2005-2696.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2429 
Firefox, when opening Microsoft Word documents, does not properly set the permissions on shared sections, which allows remote attackers to write arbitrary data to open applications in Microsoft Office.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z
CVE-2005-2430 
Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) forum_id or (2) group_id parameter to forum.php, (3) project_task_id parameter to task.php, (4) id parameter to detail.php, (5) the text field on the search page, (6) group_id parameter to qrs.php, (7) form, (8) rows, (9) cols or (10) wrap parameter to notepad.php, or the login field on the login form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2005-08-03T04:00:00.000Z