rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-2410 
Unspecified vulnerability in the Cabo/UIX component in Oracle Fusion Middleware 10.1.2.3 and 10.1.3.5 allows remote attackers to affect integrity via unknown vectors, a different vulnerability than CVE-2010-2395 and CVE-2010-2409.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T22:00:00.000Z
CVE-2010-2411 
Unspecified vulnerability in the Job Queue component in Oracle Database Server 11.2.0.1, 11.1.0.7, 10.2.0.3, 10.2.0.4, and 10.1.0.5 allows remote authenticated users to affect confidentiality, integrity, and availability, related to SYS.DBMS_IJOB.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T22:00:00.000Z
CVE-2010-2412 
Unspecified vulnerability in the OLAP component in Oracle Database Server 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2413 
Unspecified vulnerability in the BI Publisher component in Oracle Fusion Middleware 10.1.3.3.2 and 10.1.3.4.1 allows remote attackers to affect integrity via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2414 
Unspecified vulnerability in the (1) Sun Convergence 1 and (2) Sun Java Communications Suite 7 components in Oracle Sun Products Suite 1.0 and 7.0 allows remote attackers to affect confidentiality via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2415 
Unspecified vulnerability in the Change Data Capture component in Oracle Database Server 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality and integrity, related to DBMS_CDC_PUBLISH.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2416 
Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2417 
Unspecified vulnerability in the Agile PLM component in Oracle Supply Chain Products Suite 9.3.0.0 allows remote authenticated users to affect integrity via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2418 
Unspecified vulnerability in the Oracle Territory Management component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2419 
Unspecified vulnerability in the Java Virtual Machine component in Oracle Database Server 10.1.0.5, 10.2.0.4, 11.1.0.7, and 11.2.0.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-2420 
Multiple unspecified vulnerabilities in Fenrir Inc. ActiveGeckoBrowser 1.0.0 and 1.0.5 alpha, a module for the Sleipnir web browser, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors related to the Gecko engine.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-22T17:00:00.000Z
CVE-2010-2421 
Multiple unspecified vulnerabilities in Opera before 10.54 have unknown impact and attack vectors related to (1) "extremely severe," (2) "highly severe," (3) "moderately severe," and (4) "less severe" issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-22T17:00:00.000Z
CVE-2010-2422 
Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T17:13:00.000Z
CVE-2010-2425 
Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows remote authenticated users to read or delete arbitrary files via "..//" sequences in a COMB command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T17:13:00.000Z
CVE-2010-2426 
Directory traversal vulnerability in TitanFTPd in South River Technologies Titan FTP Server 8.10.1125, and probably earlier versions, allows remote authenticated users to read arbitrary files, determine file size, via "..//" sequences in the xcrc command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T17:13:00.000Z
CVE-2010-2427 
VMware Studio 2.0 does not properly write to temporary files, which allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-22T01:00:00.000Z
CVE-2010-2428 
Cross-site scripting (XSS) vulnerability in admin_loginok.html in the Administrator web interface in Wing FTP Server for Windows 3.5.0 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T17:13:00.000Z
CVE-2010-2429 
Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.1.2, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer in a "404 Not Found" response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T17:13:00.000Z
CVE-2010-2431 
The cupsFileOpen function in CUPS before 1.4.4 allows local users, with lp group membership, to overwrite arbitrary files via a symlink attack on the (1) /var/cache/cups/remote.cache or (2) /var/cache/cups/job.cache file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-22T20:24:00.000Z
CVE-2010-2432 
The cupsDoAuthentication function in auth.c in the client in CUPS before 1.4.4, when HAVE_GSSAPI is omitted, does not properly handle a demand for authorization, which allows remote CUPS servers to cause a denial of service (infinite loop) via HTTP_UNAUTHORIZED responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-22T20:24:00.000Z
CVE-2010-2433 
Multiple cross-site scripting (XSS) vulnerabilities in content/internalError.jsp in IBM WebSphere ILOG JRules 6.7 allow remote attackers to inject arbitrary web script or HTML via an RTS URL to (1) explore/explore.jsp, (2) compose/compose.jsp, or (3) home.jsp in faces/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-23T19:00:00.000Z
CVE-2010-2434 
Buffer overflow in Arcext.dll 2.16.1 and earlier in pon software Explzh 5.62 and earlier allows remote attackers to execute arbitrary code via an LZH LHA file with a crafted header that is not properly handled during expansion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T18:00:00.000Z
CVE-2010-2435 
Weborf HTTP Server 0.12.1 and earlier allows remote attackers to cause a denial of service (crash) via Unicode characters in a Connection HTTP header, and possibly other headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2436 
SQL injection vulnerability in modules/blog/index.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2437 
Cross-site scripting (XSS) vulnerability in class/tools.class.php in AneCMS Blog 1.3 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the comment variable to modules/blog/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2438 
SQL injection vulnerability in G.CMS generator allows remote attackers to execute arbitrary SQL commands via the lang parameter to the default URI, probably index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2439 
Stack-based buffer overflow in MoreAmp allows remote attackers to execute arbitrary code via a long line in a song list (.maf file).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2440 
Stack-based buffer overflow in st-wizard.exe in Subtitle Translation Wizard 3.0 allows user-assisted remote attackers to execute arbitrary code via a crafted SRT file with a long line after a time range.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2441 
WebKit does not properly restrict focus changes, which allows remote attackers to read keystrokes via "cross-domain IFRAME gadgets," a different vulnerability than CVE-2010-1126, CVE-2010-1422, and CVE-2010-2295.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2442 
Microsoft Internet Explorer, possibly 8, does not properly restrict focus changes, which allows remote attackers to read keystrokes via "cross-domain IFRAME gadgets."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2443 
The OJPEGReadBufferFill function in tif_ojpeg.c in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an OJPEG image with undefined strip offsets, related to the TIFFVGetField function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-24T17:00:00.000Z
CVE-2010-2444 
parse/Csv2_parse.c in MaraDNS 1.3.03, and other versions before 1.4.03, does not properly handle hostnames that do not end in a "." (dot) character, which allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted csv2 zone file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T18:00:00.000Z
CVE-2010-2445 
freeciv 2.2 before 2.2.1 and 2.3 before 2.3.0 allows attackers to read arbitrary files or execute arbitrary commands via a scenario that contains Lua functionality, related to the (1) os, (2) io, (3) package, (4) dofile, (5) loadfile, (6) loadlib, (7) module, and (8) require modules or functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-07T18:00:00.000Z
CVE-2010-2446 
Rbot Reaction plugin allows command execution
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T16:19:09.000Z
CVE-2010-2447 
gitolite before 1.4.1 does not filter src/ or hooks/ from path names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-07T19:32:29.000Z
CVE-2010-2448 
znc.cpp in ZNC before 0.092 allows remote authenticated users to cause a denial of service (crash) by requesting traffic statistics when there is an active unauthenticated connection, which triggers a NULL pointer dereference, as demonstrated using (1) a traffic link in the web administration pages or (2) the traffic command in the /znc shell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-12T17:00:00.000Z
CVE-2010-2449 
Gource through 0.26 logs to a predictable file name (/tmp/gource-$UID.tmp), enabling attackers to overwrite an arbitrary file via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-07T19:46:01.000Z
CVE-2010-2450 
The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-07T20:06:05.000Z
CVE-2010-2451 
Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-29T18:00:00.000Z
CVE-2010-2452 
Directory traversal vulnerability in the DCC functionality in KVIrc 3.4 and 4.0 allows remote attackers to overwrite arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-29T18:00:00.000Z
CVE-2010-2453 
Multiple cross-site scripting (XSS) vulnerabilities in Synology Disk Station 2.x before DSM3.0-1337 allow remote attackers to inject arbitrary web script or HTML by connecting to the FTP server and providing a crafted (1) USER or (2) PASS command, which is written by the FTP logging module to a web-interface log window, related to a "web commands injection" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-29T16:00:00.000Z
CVE-2010-2454 
Apple Safari does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T19:00:00.000Z
CVE-2010-2455 
Opera does not properly manage the address bar between the request to open a URL and the retrieval of the new document's content, which might allow remote attackers to conduct spoofing attacks via a crafted HTML document, a related issue to CVE-2010-1206.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T19:00:00.000Z
CVE-2010-2456 
Multiple directory traversal vulnerabilities in index.php in Linker IMG 1.0 and earlier allow remote attackers to read and execute arbitrary local files via a URL in the (1) cook_lan cookie parameter ($lan_dir variable) or possibly (2) Sdb_type parameter.  NOTE: this was originally reported as remote file inclusion, but this may be inaccurate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2457 
Cross-site scripting (XSS) vulnerability in index.php in K-Search allows remote attackers to inject arbitrary web script or HTML via the term parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2458 
Cross-site scripting (XSS) vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to inject arbitrary web script or HTML via the videoid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2459 
SQL injection vulnerability in video.php in 2daybiz Video Community Portal Script 1.0 allows remote attackers to execute arbitrary SQL commands via the videoid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2460 
SQL injection vulnerability in merchant_product_list.php in JCE-Tech Shareasale Script (SASS) 1 allows remote attackers to execute arbitrary SQL commands via the mechant_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2461 
SQL injection vulnerability in storecat.php in JCE-Tech Overstock 1 allows remote attackers to execute arbitrary SQL commands via the store parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2462 
SQL injection vulnerability in withdraw_money.php in Toma Cero OroHYIP allows remote attackers to execute arbitrary SQL commands via the id parameter in a cancel action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2463 
Cross-site scripting (XSS) vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the post_id parameter in a modify action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2464 
Multiple cross-site scripting (XSS) vulnerabilities in the RSComments (com_rscomments) component 1.0.0 Rev 2 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) website and (2) name parameters to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2465 
The S2 Security NetBox 2.5, 3.3, and 4.0, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, stores sensitive information under the web root with insufficient access control, which allows remote attackers to download node logs, photographs of persons, and backup files via unspecified HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2466 
The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not properly prevent downloading of database backups, which allows remote attackers to obtain sensitive information via requests for full_*.dar files with predictable filenames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2467 
The S2 Security NetBox, possibly 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, does not require setting a password for the FTP server that stores database backups, which makes it easier for remote attackers to download backup files via unspecified FTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2468 
The S2 Security NetBox 2.x and 3.x, as used in the Linear eMerge 50 and 5000 and the Sonitrol eAccess, uses a weak hash algorithm for storing the Administrator password, which makes it easier for context-dependent attackers to obtain privileged access by recovering the cleartext of this password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2469 
The Linear eMerge 50 and 5000 uses a default password of eMerge for the IEIeMerge account, which makes it easier for remote attackers to obtain Video Recorder data by establishing a session to the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-25T21:00:00.000Z
CVE-2010-2470 
Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/, which allows local users to obtain potentially sensitive data by reading files in these directories, a different vulnerability than CVE-2010-0180.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T17:00:00.000Z
CVE-2010-2471 
Drupal versions 5.x and 6.x has open redirection
Problem types: description: redirection
Affected products: vendor: Drupal
product: drupal6
Published: 2019-11-06T17:09:06.000Z
CVE-2010-2472 
Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.
Problem types: description: module cross site scripting
Affected products: vendor: drupal6
product: drupal6
Published: 2019-11-07T18:05:33.000Z
CVE-2010-2473 
Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked.
Problem types: description: user session regeneration
Affected products: vendor: drupal6
product: drupal6
Published: 2019-11-07T18:11:35.000Z
CVE-2010-2474 
JBoss Enterprise Service Bus (ESB) before 4.7 CP02 in JBoss Enterprise SOA Platform before 5.0.2 does not properly consider the security domain with which a service is secured, which might allow remote attackers to gain privileges by executing a service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-09T20:00:00.000Z
CVE-2010-2476 
syscp 1.4.2.1 allows attackers to add arbitrary paths via the documentroot of a domain by appending a colon to it and setting the open basedir path to use that domain documentroot.
Problem types: description: open_basedir bypassing
Affected products: vendor: syscp
product: syscp
Published: 2019-11-07T20:19:44.000Z
CVE-2010-2477 
Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3) paste.urlmap.URLMap, and (4) HTTPNotFound.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-2478 
Integer overflow in the ethtool_get_rxnfc function in net/core/ethtool.c in the Linux kernel before 2.6.33.7 on 32-bit platforms allows local users to cause a denial of service or possibly have unspecified other impact via an ETHTOOL_GRXCLSRLALL ethtool command with a large info.rule_cnt value that triggers a buffer overflow, a different vulnerability than CVE-2010-3084.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-29T16:00:00.000Z
CVE-2010-2479 
Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-06T17:00:00.000Z
CVE-2010-2480 
Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-02T18:30:00.000Z
CVE-2010-2481 
The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-06T14:00:00.000Z