rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-1414 
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the removeChild DOM method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T17:28:00.000Z
CVE-2010-1415 
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle libxml contexts, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to an "API abuse issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T17:28:00.000Z
CVE-2010-1416 
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly restrict the reading of a canvas that contains an SVG image pattern from a different web site, which allows remote attackers to read images from other sites via a crafted canvas, related to a "cross-site image capture issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T17:28:00.000Z
CVE-2010-1417 
The Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via HTML content that contains multiple :after pseudo-selectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T17:28:00.000Z
CVE-2010-1418 
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via a FRAME element with a SRC attribute composed of a javascript: sequence preceded by spaces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T19:00:00.000Z
CVE-2010-1419 
Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving a certain window close action that occurs during a drag-and-drop operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T19:00:00.000Z
CVE-2010-1420 
Cross-site scripting (XSS) vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-21T23:00:00.000Z
CVE-2010-1421 
The execCommand JavaScript function in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly restrict remote execution of clipboard commands, which allows remote attackers to modify the clipboard via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T19:00:00.000Z
CVE-2010-1422 
WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not properly handle changes to keyboard focus that occur during processing of key press events, which allows remote attackers to force arbitrary key presses via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T17:28:00.000Z
CVE-2010-1423 
Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-15T21:12:00.000Z
CVE-2010-1424 
Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government 2006 through 2010 allows user-assisted remote attackers to execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-15T21:12:00.000Z
CVE-2010-1425 
F-Secure Internet Security 2010 and earlier; Anti-Virus for Microsoft Exchange 9 and earlier, and for MIMEsweeper 5.61 and earlier; Internet Gatekeeper for Windows 6.61 and earlier, and for Linux 4.02 and earlier; Anti-Virus 2010 and earlier; Home Server Security 2009; Protection Service for Consumers 9 and earlier, for Business - Workstation security 9 and earlier, for Business - Server Security 8 and earlier, and for E-mail and Server security 9 and earlier; Mac Protection build 8060 and earlier; Client Security 9 and earlier; and various Anti-Virus products for Windows, Linux, and Citrix; does not properly detect malware in crafted (1) 7Z, (2) GZIP, (3) CAB, or (4) RAR archives, which makes it easier for remote attackers to avoid detection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-15T21:12:00.000Z
CVE-2010-1426 
SQL injection vulnerability in MODx Evolution before 1.0.3 allows remote attackers to execute arbitrary SQL commands via unknown vectors related to WebLogin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-15T21:12:00.000Z
CVE-2010-1427 
Cross-site scripting (XSS) vulnerability in the SearchHighlight plugin in MODx Evolution before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors related to AjaxSearch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-15T21:12:00.000Z
CVE-2010-1428 
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to obtain sensitive information via an unspecified request that uses a different method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-28T22:00:00.000Z
CVE-2010-1429 
Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.  NOTE: this issue exists because of a CVE-2008-3273 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-28T22:00:00.000Z
CVE-2010-1431 
SQL injection vulnerability in templates_export.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via the export_item_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-04T15:00:00.000Z
CVE-2010-1432 
Joomla! Core is prone to an information disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Problem types: cwe_id: CWE-200
description: CWE-200
Affected products: vendor: n/a
product: Joomla
Published: 2021-06-21T22:10:14.000Z
CVE-2010-1433 
Joomla! Core is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to properly verify user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Problem types: cwe_id: CWE-434
description: CWE-434
Affected products: vendor: n/a
product: Joomla
Published: 2021-06-21T22:13:29.000Z
CVE-2010-1434 
Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Problem types: cwe_id: CWE-384
description: CWE-384
Affected products: vendor: n/a
product: Joomla
Published: 2021-06-21T22:22:07.000Z
CVE-2010-1435 
Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently retrieve password reset tokens from the database through an already existing SQL injection vector. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: Joomla
Published: 2021-06-21T22:24:23.000Z
CVE-2010-1436 
gfs2 in the Linux kernel 2.6.18, and possibly other versions, does not properly handle when the gfs2_quota struct occupies two separate pages, which allows local users to cause a denial of service (kernel panic) via certain manipulations that cause an out-of-bounds write, as demonstrated by writing from an ext3 file system to a gfs2 file system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-21T17:00:00.000Z
CVE-2010-1437 
Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2010-1438 
Web Application Finger Printer (WAFP) 0.01-26c3 uses fixed pathnames under /tmp for temporary files and directories, which (1) allows local users to cause a denial of service (application outage) by creating a file with a pathname that the product expects is available for its own internal use, (2) allows local users to overwrite arbitrary files via symlink attacks on certain files in /tmp, (3) might allow local users to delete arbitrary files and directories via a symlink attack on a directory under /tmp, and (4) might make it easier for local users to obtain sensitive information by reading files in a directory under /tmp, related to (a) lib/wafp_pidify.rb, (b) utils/generate_wafp_fingerprint.sh, (c) utils/online_update.sh, and (d) utils/extract_from_db.sh.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T14:00:00.000Z
CVE-2010-1439 
yum-rhn-plugin in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Enterprise Linux (RHEL) 5 and Fedora uses world-readable permissions for the /var/spool/up2date/loginAuth.pkl file, which allows local users to access the Red Hat Network profile, and possibly prevent future security updates, by leveraging authentication data from this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-07T14:00:00.000Z
CVE-2010-1440 
Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T17:43:00.000Z
CVE-2010-1441 
Multiple heap-based buffer overflows in VideoLAN VLC media player before 1.0.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) A/52, (2) DTS, or (3) MPEG Audio decoder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T20:00:00.000Z
CVE-2010-1442 
VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted byte stream to the (1) AVI, (2) ASF, or (3) Matroska (aka MKV) demuxer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T20:00:00.000Z
CVE-2010-1443 
The parse_track_node function in modules/demux/playlist/xspf.c in the XSPF playlist parser in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty location element in an XML Shareable Playlist Format (XSPF) document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T20:00:00.000Z
CVE-2010-1444 
The ZIP archive decompressor in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly execute arbitrary code via a crafted archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T20:00:00.000Z
CVE-2010-1445 
Heap-based buffer overflow in VideoLAN VLC media player before 1.0.6 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted byte stream in an RTMP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-26T20:00:00.000Z
CVE-2010-1446 
arch/powerpc/mm/fsl_booke_mmu.c in KGDB in the Linux kernel 2.6.30 and other versions before 2.6.33, when running on PowerPC, does not properly perform a security check for access to a kernel page, which allows local users to overwrite arbitrary kernel memory, related to Fsl booke.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-21T17:00:00.000Z
CVE-2010-1447 
The Safe (aka Safe.pm) module 2.26, and certain earlier versions, for Perl, as used in PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2, allows context-dependent attackers to bypass intended (1) Safe::reval and (2) Safe::rdo access restrictions, and inject and execute arbitrary code, via vectors involving subroutine references and delayed execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-19T18:13:00.000Z
CVE-2010-1448 
Cross-site scripting (XSS) vulnerability in lib/LXR/Common.pm in LXR Cross Referencer before 0.9.8 allows remote attackers to inject arbitrary web script or HTML via vectors related to a string in the search page's TITLE element, a different vulnerability than CVE-2009-4497 and CVE-2010-1625.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T18:00:00.000Z
CVE-2010-1449 
Integer overflow in rgbimgmodule.c in the rgbimg module in Python 2.5 allows remote attackers to have an unspecified impact via a large image that triggers a buffer overflow.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-3143.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T19:00:00.000Z
CVE-2010-1450 
Multiple buffer overflows in the RLE decoder in the rgbimg module in Python 2.5 allow remote attackers to have an unspecified impact via an image file containing crafted data that triggers improper processing within the (1) longimagedata or (2) expandrow function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T19:00:00.000Z
CVE-2010-1451 
The TSB I-TLB load implementation in arch/sparc/kernel/tsb.S in the Linux kernel before 2.6.33 on the SPARC platform does not properly obtain the value of a certain _PAGE_EXEC_4U bit and consequently does not properly implement a non-executable stack, which makes it easier for context-dependent attackers to exploit stack-based buffer overflows via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2010-1452 
The (1) mod_cache and (2) mod_dav modules in the Apache HTTP Server 2.2.x before 2.2.16 allow remote attackers to cause a denial of service (process crash) via a request that lacks a path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-1453 
Cross-site scripting (XSS) vulnerability in the Login form in Piwik 0.1.6 through 0.5.5 allows remote attackers to inject arbitrary web script or HTML via the form_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T17:43:00.000Z
CVE-2010-1454 
com.springsource.tcserver.serviceability.rmi.JmxSocketListener in VMware SpringSource tc Server Runtime 6.0.19 and 6.0.20 before 6.0.20.D, and 6.0.25.A before 6.0.25.A-SR01, does not properly enforce the requirement for an encrypted (aka s2enc) password, which allows remote attackers to obtain JMX interface access via a blank password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-19T18:13:00.000Z
CVE-2010-1455 
The DOCSIS dissector in Wireshark 0.9.6 through 1.0.12 and 1.2.0 through 1.2.7 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed packet trace file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-11T23:00:00.000Z
CVE-2010-1457 
Tools/gdomap.c in gdomap in GNUstep Base before 1.20.0 allows local users to read arbitrary files via a (1) -c or (2) -a option, which prints file contents in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-12T01:00:00.000Z
CVE-2010-1458 
Stack-based buffer overflow in Create and Extract Zips TweakFS Zip Utility 1.0 for Flight Simulator X (FSX) allows remote attackers to execute arbitrary code via a long filename in a ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T16:00:00.000Z
CVE-2010-1459 
The default configuration of ASP.NET in Mono before 2.6.4 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by the __VIEWSTATE parameter to 2.0/menu/menu1.aspx in the XSP sample project.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T18:32:00.000Z
CVE-2010-1460 
The IBM BladeCenter with Advanced Management Module (AMM) firmware before bpet50g does not properly perform interrupt sharing for USB and iSCSI, which allows remote attackers to cause a denial of service (management module reboot) via TCP packets with malformed application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T18:00:00.000Z
CVE-2010-1461 
Directory traversal vulnerability in the Photo Battle (com_photobattle) component 1.0.1 for Joomla! allows remote attackers to read arbitrary files via the view parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T19:00:00.000Z
CVE-2010-1462 
Directory traversal vulnerability in WebAsyst Shop-Script FREE has unknown impact and attack vectors via the sub parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T19:00:00.000Z
CVE-2010-1463 
Multiple SQL injection vulnerabilities in WebAsyst Shop-Script FREE allow attackers to execute arbitrary SQL commands via the (1) add2cart, (2) c_id, (3) categoryID, (4) list_price, (5) name, (6) new_offer, (7) price, (8) product_code, (9) productID, (10) rating, and (11) save_product parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T19:00:00.000Z
CVE-2010-1464 
Multiple cross-site scripting (XSS) vulnerabilities in WebAsyst Shop-Script FREE allow remote attackers to inject arbitrary web script or HTML via the (1) currency_id_left, (2) currency_id_right, (3) darkcolor, (4) lightcolor, (5) middlecolor, and (6) w parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T19:00:00.000Z
CVE-2010-1465 
Stack-based buffer overflow in Trellian FTP client 3.01, including 3.1.3.1789, allows remote attackers to execute arbitrary code via a long PASV response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T19:00:00.000Z
CVE-2010-1466 
Directory traversal vulnerability in scr/soustab.php in openUrgence Vaccin 1.03 allows remote attackers to read arbitrary files via the dsn[phptype] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T19:00:00.000Z
CVE-2010-1467 
Multiple PHP remote file inclusion vulnerabilities in openUrgence Vaccin 1.03 allow remote attackers to execute arbitrary PHP code via a URL in the path_om parameter to (1) collectivite.class.php, (2) injection.class.php, (3) utilisateur.class.php, (4) droit.class.php, (5) laboratoire.class.php, (6) vaccin.class.php, (7) effetsecondaire.class.php, (8) medecin.class.php, (9) individu.class.php, and (10) profil.class.php in gen/obj/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T19:00:00.000Z
CVE-2010-1468 
SQL injection vulnerability in the Multi-Venue Restaurant Menu Manager (aka MVRMM or com_mv_restaurantmenumanager) component 1.5.2 Stable Update 3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the mid parameter in a menu_display action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-19T19:04:00.000Z
CVE-2010-1469 
Directory traversal vulnerability in the Ternaria Informatica JProject Manager (com_jprojectmanager) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-19T19:04:00.000Z
CVE-2010-1470 
Directory traversal vulnerability in the Web TV (com_webtv) component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-19T19:04:00.000Z
CVE-2010-1471 
Directory traversal vulnerability in the AddressBook (com_addressbook) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-19T19:04:00.000Z
CVE-2010-1472 
Directory traversal vulnerability in the Daily Horoscope (com_horoscope) component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-19T19:04:00.000Z