Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/web/20221203195056/https://itsecuritysolutions.org/2012-09-21-ZEN-Load-Balancer-v2.0-and-v3.0-rc1-multiple-vulnerabilities/ - https://web.archive.org/web/20111015031540/http://www.zenloadbalancer.com/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/zen_load_balancer_exec.rb - https://www.exploit-db.com/exploits/21849 - https://www.fortiguard.com/encyclopedia/ips/33335/zen-load-balancer-filelog-command-execution
CVE ID: CVE-2012-10040 State: PUBLISHED Published: 2025-08-11T14:56:01.862Z Last Updated: 2025-11-20T21:58:32.500Z Vendors: Openfiler Products: Openfiler Problem Types: CWE-78 Description: Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to misconfigured sudoers, the openfiler user can escalate privileges to root via sudo /bin/bash without a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw
root via sudo /bin/bash without a password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/openfiler_networkcard_exec.rb - https://www.exploit-db.com/exploits/21191 - https://www.openfiler.com/ - https://sourceforge.net/projects/openfiler/ - http://web.archive.org/web/20210922060411/https://itsecuritysolutions.org/2012-09-06-Openfiler-v2.x-multiple-vulnerabilities/
CVE ID: CVE-2012-10041 State: PUBLISHED Published: 2025-08-08T18:13:25.483Z Last Updated: 2025-08-08T18:45:42.058Z Vendors: WAN Emulator Products: WAN Emulator Problem Types: CWE-78 Description: WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shell_exec() with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary named dosu, which is vulnerable to command injection via its first argument. An attacker can exploit both flaws in sequence to achieve full remote code execution and escalate privileges to root. Additional Ana
can exploit both flaws in sequence to achieve full remote code execution and escalate privileges to root. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/wanem_exec.rb - https://www.exploit-db.com/exploits/21190 - https://sourceforge.net/projects/wanem/ - https://www.vulncheck.com/advisories/wan-emulator-command-execution
CVE ID: CVE-2012-10042 State: PUBLISHED Published: 2025-08-08T18:12:32.270Z Last Updated: 2025-08-08T18:49:25.841Z Vendors: Sflog! Products: Sflog! CMS Problem Types: CWE-434 Description: Sflog! CMS 1.0 contains an authenticated arbitrary file upload vulnerability in the blog management interface. The application ships with default credentials (admin:secret) and allows authenticated users to upload files via manage.php. The upload mechanism fails to validate file types, enabling attackers to upload a PHP backdoor into a web-accessible directory (blogs/download/uploads/). Once uploaded, the file can be executed remotely, resulting in full remote code execution. Additional Analyst Notes: - CIS
ce uploaded, the file can be executed remotely, resulting in full remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/sflog_upload_exec.rb - https://www.exploit-db.com/exploits/19626 - https://sourceforge.net/projects/sflog/ - https://www.vulncheck.com/advisories/sflog-cms-arbitrary-file-upload-rce
CVE ID: CVE-2012-10043 State: PUBLISHED Published: 2025-08-08T18:09:17.239Z Last Updated: 2025-08-08T19:02:10.295Z Vendors: ActFax Products: Server Problem Types: CWE-121 Description: A stack-based buffer overflow vulnerability exists in ActFax Server version 4.32, specifically in the "Import Users from File" functionality of the client interface. The application fails to properly validate the length of tab-delimited fields in .exp files, leading to unsafe usage of strcpy() during CSV parsing. An attacker can exploit this vulnerability by crafting a malicious .exp file and importing it using the default character set "ECMA-94 / Latin 1 (ISO 8859)". Successful exploitation may result in arbit
importing it using the default character set "ECMA-94 / Latin 1 (ISO 8859)". Successful exploitation may result in arbitrary code execution, leading to full system compromise. User interaction is required to trigger the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/actfax_import_users_bof.rb - https://www.exploit-db.com/exploits/20915 - https://web.archive.org/web/20130712072809/http://www.pwnag3.com/2012/08/actfax-local-privilege-escalation.html - https://www.actfax.com/ - https://www.vulncheck.com/advisories/actfax-client-importer-buffer-overflow
CVE ID: CVE-2012-10044 State: PUBLISHED Published: 2025-08-08T18:11:31.472Z Last Updated: 2025-08-08T18:53:06.053Z Vendors: MobileCartly Products: MobileCartly Problem Types: CWE-434 Description: MobileCartly version 1.0 contains an arbitrary file creation vulnerability in the savepage.php script. The application fails to perform authentication or authorization checks before invoking file_put_contents() on attacker-controlled input. An unauthenticated attacker can exploit this flaw by sending crafted HTTP GET requests to savepage.php, specifying both the filename and content. This allows arbitrary file creation within the pages/ directory or any writable path on the server, allowing remote c
t. This allows arbitrary file creation within the pages/ directory or any writable path on the server, allowing remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/mobilecartly_upload_exec.rb - https://www.exploit-db.com/exploits/20422 - https://www.exploit-db.com/exploits/21079 - https://web.archive.org/web/20120919081957/http://mobilecartly.com/ - https://www.vulncheck.com/advisories/mobilecartly-arbitrary-file-creation
CVE ID: CVE-2012-10045 State: PUBLISHED Published: 2025-08-08T18:14:08.705Z Last Updated: 2025-08-08T18:43:21.963Z Vendors: XODA Products: XODA Problem Types: CWE-434 Description: XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https:/
ger its execution via a subsequent GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/xoda_file_upload.rb - https://www.exploit-db.com/exploits/20703 - https://www.exploit-db.com/exploits/20713 - https://xoda.org/ - https://sourceforge.net/projects/xoda/ - https://www.vulncheck.com/advisories/xoda-arbitrary-php-file-upload
CVE ID: CVE-2012-10046 State: PUBLISHED Published: 2025-08-08T18:11:08.292Z Last Updated: 2025-08-08T18:54:01.060Z Vendors: ESVA-Project Products: E-Mail Security Virtual Appliance Problem Types: CWE-78 Description: The E-Mail Security Virtual Appliance (ESVA) (tested on version ESVA_2057) contains an unauthenticated command injection vulnerability in the learn-msg.cgi script. The CGI handler fails to sanitize user-supplied input passed via the id parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and results in full command execution on the underlying system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourc
mmand execution on the underlying system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/esva-project/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/esva_exec.rb - https://www.exploit-db.com/exploits/20551 - https://www.exploit-db.com/exploits/20712 - https://www.vulncheck.com/advisories/email-security-virtual-appliance-command-injection
CVE ID: CVE-2012-10047 State: PUBLISHED Published: 2025-08-08T18:10:24.982Z Last Updated: 2025-08-08T18:59:31.525Z Vendors: Cyclope-Series Products: Cyclope Employee Surveillance Solution Problem Types: CWE-89 Description: Cyclope Employee Surveillance Solution versions 6.x is vulnerable to a SQL injection flaw in its login mechanism. The username parameter in the auth-login POST request is not properly sanitized, allowing attackers to inject arbitrary SQL statements. This can be leveraged to write and execute a malicious PHP file on disk, resulting in remote code execution under the SYSTEM user context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubuserc
under the SYSTEM user context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/cyclope_ess_sqli.rb - https://www.exploit-db.com/exploits/20393 - https://www.exploit-db.com/exploits/20501 - https://www.cyclope-series.com/ - https://www.vulncheck.com/advisories/cyclope-employee-surveillance-solution-sql-injection
CVE ID: CVE-2012-10048 State: PUBLISHED Published: 2025-08-08T18:14:38.811Z Last Updated: 2025-11-20T22:01:24.551Z Vendors: Zenoss, Inc. Products: Zenoss Core Problem Types: CWE-22 Description: Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/20205 - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/zenoss_sh
loits/20205 - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb - https://www.exploit-db.com/exploits/37571 - http://web.archive.org/web/20221203180334/https://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/ - https://sourceforge.net/projects/zenoss/ - https://www.vulncheck.com/advisories/zenoss-command-execution
CVE ID: CVE-2012-10049 State: PUBLISHED Published: 2025-08-08T18:13:47.402Z Last Updated: 2025-08-08T18:44:49.016Z Vendors: WPO Foundation Products: WebPageTest Problem Types: CWE-434 Description: WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metas
context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/webpagetest_upload_exec.rb - https://www.exploit-db.com/exploits/19790 - https://www.exploit-db.com/exploits/20173 - https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=26148 - https://github.com/catchpoint/WebPageTest - https://www.vulncheck.com/advisories/webpagetest-arbitrary-php-file-upload-rce
CVE ID: CVE-2012-10050 State: PUBLISHED Published: 2025-08-08T18:10:03.287Z Last Updated: 2025-08-08T19:00:18.289Z Vendors: CuteFlow.org Products: CuteFlow Problem Types: CWE-434 Description: CuteFlow version 2.11.2 and earlier contains an arbitrary file upload vulnerability in the restart_circulation_values_write.php script. The application fails to validate or restrict uploaded file types, allowing unauthenticated attackers to upload arbitrary PHP files to the upload/___1/ directory. These files are then accessible via the web server, enabling remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/web/20120729071444/http://www.cutefl
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://web.archive.org/web/20120729071444/http://www.cuteflow.org/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/cuteflow_upload_exec.rb - https://www.exploit-db.com/exploits/20111 - http://web.archive.org/web/20210922054637/https://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/ - https://sourceforge.net/projects/cuteflow/ - https://www.vulncheck.com/advisories/cuteflow-arbitrary-file-upload-rce
CVE ID: CVE-2012-10051 State: PUBLISHED Published: 2025-08-08T18:11:52.527Z Last Updated: 2025-11-20T22:05:33.978Z Vendors: Photodex Corporation Products: ProShow Producer Problem Types: CWE-121 Description: Photodex ProShow Producer version 5.0.3256 contains a stack-based buffer overflow vulnerability in the handling of plugin load list files. When a specially crafted load file is placed in the installation directory, the application fails to properly validate its contents, leading to a buffer overflow when the file is parsed during startup. Exploitation requires local access to place the file and user interaction to launch the application. Additional Analyst Notes: - CISA ADP Vulnrichment:
ess to place the file and user interaction to launch the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/proshow_load_bof.rb - https://www.exploit-db.com/exploits/19563 - https://www.exploit-db.com/exploits/20109 - https://web.archive.org/web/20120727035341/http://security.inshell.net/advisory/30 - https://www.fortiguard.com/encyclopedia/ips/32753 - https://erinkrespan.com/what-happened-to-photodex-proshow-producer/ - https://archive.org/details/PhotodexProShowProducer7.0.3514Keymaker_20180127 - https://www.vulncheck.com/advisories/photodex-proshow-producer-l
ails/PhotodexProShowProducer7.0.3514Keymaker_20180127 - https://www.vulncheck.com/advisories/photodex-proshow-producer-load-file-handling-buffer-overflow
CVE ID: CVE-2012-10052 State: PUBLISHED Published: 2025-08-08T18:10:46.550Z Last Updated: 2025-08-08T18:55:06.700Z Vendors: EGallery Products: EGallery Problem Types: CWE-434 Description: EGallery version 1.2 contains an unauthenticated arbitrary file upload vulnerability in the uploadify.php script. The application fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files directly into the web-accessible egallery/ directory. This results in full remote code execution under the web server context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/e
s: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/egallery_upload_exec.rb - https://www.exploit-db.com/exploits/20029 - http://web.archive.org/web/20170128123244/http://www.opensyscom.fr/Actualites/egallery-arbitrary-file-upload-vulnerability.html - https://sourceforge.net/projects/e-gallery/ - https://www.vulncheck.com/advisories/egallery-arbitrary-php-file-upload
CVE ID: CVE-2012-10053 State: PUBLISHED Published: 2025-08-08T18:12:53.677Z Last Updated: 2025-08-08T18:48:37.339Z Vendors: PMSoftware Products: Simple Web Server Problem Types: CWE-121 Description: Simple Web Server 2.2 rc2 contains a stack-based buffer overflow vulnerability in its handling of the Connection HTTP header. When a remote attacker sends an overly long string in this header, the server uses vsprintf() without proper bounds checking, leading to a buffer overflow on the stack. This flaw allows remote attackers to execute arbitrary code with the privileges of the web server process. The vulnerability is triggered before authentication. Additional Analyst Notes: - CISA ADP Vulnrich
web server process. The vulnerability is triggered before authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/sws_connection_bof.rb - https://www.exploit-db.com/exploits/19937 - https://www.exploit-db.com/exploits/20028 - http://ghostinthelab.wordpress.com/2012/07/19/simplewebserver-2-2-rc2-remote-buffer-overflow-exploit/ - http://www.pmx.it/software/sws.asp - https://www.vulncheck.com/advisories/simple-web-server-connection-header-buffer-overflow
CVE ID: CVE-2012-10054 State: PUBLISHED Published: 2025-08-13T20:54:39.123Z Last Updated: 2025-11-20T22:28:54.447Z Vendors: Umbraco Products: CMS Problem Types: CWE-434, CWE-22 Description: Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubuserco
ory and execute them remotely. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rb - https://www.exploit-db.com/exploits/19671 - https://web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html - https://github.com/umbraco/Umbraco-CMS - https://web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692 - https://www.vulncheck.com/advisories/umbraco-cms-rce
CVE ID: CVE-2012-10055 State: PUBLISHED Published: 2025-08-13T20:33:06.598Z Last Updated: 2025-08-14T13:49:59.657Z Vendors: ComSndFTP Products: FTP Server Problem Types: CWE-134 Description: ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and aff
P chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/ftp/comsnd_ftpd_fmtstr.rb - https://www.exploit-db.com/exploits/19024 - https://www.exploit-db.com/exploits/19177 - https://web.archive.org/web/20120317214524/http://ftp.comsnd.com/ - https://www.vulncheck.com/advisories/comsndftp-user-format-string-rce
CVE ID: CVE-2012-10056 State: PUBLISHED Published: 2025-08-13T20:51:21.580Z Last Updated: 2025-08-14T14:52:38.601Z Vendors: PHP Volunteer Management Products: PHP Volunteer Management Problem Types: CWE-434 Description: PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Onc
us PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/phpvolunteer/ - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/php_volunteer_upload_exec.rb - https://www.exploit-db.com/exploits/18941 - https://www.exploit-db.com/exploits/18957 - https://www.vulncheck.com/advisories/php-volunteer-management-system-arbitrary-file-upload
CVE ID: CVE-2012-10057 State: PUBLISHED Published: 2025-08-13T20:35:07.498Z Last Updated: 2025-08-14T14:10:13.068Z Vendors: Lattice Semiconductor Products: ispVM System Problem Types: CWE-121 Description: Lattice Semiconductor ispVM System v18.0.2 contains a buffer overflow vulnerability in its handling of .xcf project files. When parsing the version attribute of the ispXCF XML tag, the application fails to properly validate input length, allowing a specially crafted file to overwrite memory on the stack. This can result in arbitrary code execution under the context of the user who opens the file. The vulnerability is triggered locally by opening a malicious .xcf file and does not require el
user who opens the file. The vulnerability is triggered locally by opening a malicious .xcf file and does not require elevated privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb - https://www.exploit-db.com/exploits/18947 - https://web.archive.org/web/20121014002756/http://secunia.com/advisories/48740/ - https://www.latticesemi.com/ispvm - https://www.vulncheck.com/advisories/lattice-semiconductor-ispvm-system-xcf-file-handling-buffer-overflow
CVE ID: CVE-2012-10058 State: PUBLISHED Published: 2025-08-13T20:52:07.004Z Last Updated: 2025-08-14T14:52:24.644Z Vendors: RabidHamster Products: R4 Embedded Server Problem Types: CWE-121 Description: RabidHamster R4 v1.25 contains a stack-based buffer overflow vulnerability due to unsafe use of sprintf() when logging malformed HTTP requests. A remote attacker can exploit this flaw by sending a specially crafted URI, resulting in arbitrary code execution under the context of the web server process. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/rabidhamster_r4_log.rb - https:
w.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/rabidhamster_r4_log.rb - https://www.exploit-db.com/exploits/18929 - http://aluigi.altervista.org/adv/r4_1-adv.txt - https://advisories.checkpoint.com/defense/advisories/public/2013/cpai-07-jan405.html - https://www.rabidhamster.org/R4/download.php - https://www.vulncheck.com/advisories/rabidhamster-r4-log-entry-buffer-overflow