rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-3567 
Cross-site scripting (XSS) vulnerability in modules/tickets/functions_ticketsui.php in Kayako SupportSuite and eSupport 3.60.04 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in the staff control panel, a different vector than CVE-2007-1145.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3568 
Comment RSS 5.x before 5.x-2.2 and 6.x before 6.x-2.2, a module for Drupal, does not properly enforce permissions when a link is added to the RSS feed, which allows remote attackers to obtain the node title and possibly other sensitive content by reading the feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3569 
Stack-based buffer overflow in OpenOffice.org (OOo) allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, aka "Client-side stack overflow exploit." NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3570 
Unspecified vulnerability in OpenOffice.org (OOo) has unspecified impact and remote attack vectors, as demonstrated by a certain module in VulnDisco Pack Professional 8.9.  NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3571 
Unspecified vulnerability in OpenOffice.org (OOo) has unknown impact and client-side attack vector, as demonstrated by a certain module in VulnDisco Pack Professional 8.8, aka "Client-side exploit." NOTE: as of 20091005, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3572 
OpenBSD 4.4, 4.5, and 4.6, when running on an i386 kernel, does not properly handle XMM exceptions, which allows local users to cause a denial of service (kernel panic) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3573 
Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ActiveX control (PDIControl.dll) 2.2.3160.0 in EMC Captiva PixTools Distributed Imaging 2.2 allow remote attackers to create or overwrite arbitrary files via the (1) SetLogFileName and (2) WriteToLog methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3574 
Tuniac 090517c allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a .pls playlist file, possibly a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-06T20:19:00.000Z
CVE-2009-3575 
Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-07T17:00:00.000Z
CVE-2009-3576 
Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to execute arbitrary JavaScript code via a scene package containing a Scene Table of Contents (aka .scntoc) file with a Script_Content element, as demonstrated by code that loads the WScript.Shell ActiveX control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-24T17:00:00.000Z
CVE-2009-3577 
Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method, related to "application callbacks."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-24T17:00:00.000Z
CVE-2009-3578 
Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya 6.5 and 7.0 allow remote attackers to execute arbitrary code via a (1) .ma or (2) .mb file that uses the Maya Embedded Language (MEL) python command or unspecified other MEL commands, related to "Script Nodes."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-24T17:00:00.000Z
CVE-2009-3579 
Cross-site scripting (XSS) vulnerability in the CookieDump.java sample application in Mort Bay Jetty 6.1.19 and 6.1.20 allows remote attackers to inject arbitrary web script or HTML via the Value parameter in a GET request to cookie/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-07T17:00:00.000Z
CVE-2009-3580 
Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger 2.8.24 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password via the login, new_password, and confirm_password parameters in a preferences action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-23T18:00:00.000Z
CVE-2009-3581 
Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via (1) the DCN Description field in the Accounts Receivables menu item for Add Transaction, (2) the Description field in the Accounts Payable menu item for Add Transaction, or the name field in (3) the Customers menu item for Add Customer or (4) the Vendor menu item for Add Vendor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-23T18:00:00.000Z
CVE-2009-3582 
Multiple SQL injection vulnerabilities in the delete subroutine in SQL-Ledger 2.8.24 allow remote authenticated users to execute arbitrary SQL commands via the (1) id and possibly (2) db parameters in a Delete action to the output of a Vendors>Reports>Search search operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-23T18:00:00.000Z
CVE-2009-3583 
Directory traversal vulnerability in the Preferences menu item in SQL-Ledger 2.8.24 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the countrycode field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-23T18:00:00.000Z
CVE-2009-3584 
SQL-Ledger 2.8.24 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-23T18:00:00.000Z
CVE-2009-3585 
Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server within the same domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-02T16:00:00.000Z
CVE-2009-3586 
Off-by-one error in src/http.c in CoreHTTP 0.5.3.1 and earlier allows remote attackers to cause a denial of service or possibly execute arbitrary code via an HTTP request with a long first line that triggers a buffer overflow.  NOTE: this vulnerability reportedly exists because of an incorrect fix for CVE-2007-4060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-08T18:00:00.000Z
CVE-2009-3587 
Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted RAR archive file that triggers heap corruption, a different vulnerability than CVE-2009-3588.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-3588 
Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption, a different vulnerability than CVE-2009-3587.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-3589 
incron 0.5.5 does not initialize supplementary groups when running a process from a user's incrontabs, which causes the process to be run with the incrond supplementary groups and allows local users to gain privileges via an incrontab table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T15:00:00.000Z
CVE-2009-3590 
SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T16:00:00.000Z
CVE-2009-3591 
Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3592 
Cross-site scripting (XSS) vulnerability in customer/home.php in Qualiteam X-Cart allows remote attackers to inject arbitrary web script or HTML via the email parameter in a subscribed action, a different vector than CVE-2005-1823.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3593 
Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to placebid.php and (2) jobid parameter to post_resume.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3594 
Cross-site scripting (XSS) vulnerability in bpost.php in BLOB Blog System before 1.2 allows remote attackers to inject arbitrary web script or HTML via the postid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3595 
SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows remote attackers to execute arbitrary SQL commands via the Cat_ID parameter, a different vector than CVE-2009-3590.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3596 
JoxTechnology Ajox Poll does not properly restrict access to admin/managepoll.php, which allows remote attackers to bypass authentication and gain administrative access via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3597 
Digitaldesign CMS 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for autoconfig.dd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3598 
Cross-site scripting (XSS) vulnerability in survey_result.php in eCardMAX FormXP 2007 allows remote attackers to inject arbitrary web script or HTML via the sid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3599 
Cross-site scripting (XSS) vulnerability in single_winner1.php in HUBScript 1.0 allows remote attackers to inject arbitrary web script or HTML via the bid_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3600 
HUBScript 1.0 allows remote attackers to obtain configuration information via a direct request to manage/phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3601 
Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez Ultimate Poll allows remote attackers to inject arbitrary web script or HTML via the clr parameter in a vote action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-08T17:00:00.000Z
CVE-2009-3602 
Unbound before 1.3.4 does not properly verify signatures for NSEC3 records, which allows remote attackers to cause secure delegations to be downgraded via DNS spoofing or other DNS-related attacks in conjunction with crafted delegation responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-3603 
Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-21T17:00:00.000Z
CVE-2009-3604 
The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before 3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document that triggers a NULL pointer dereference or a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-21T17:00:00.000Z
CVE-2009-3605 
Multiple integer overflows in Poppler 0.10.5 and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file, related to (1) glib/poppler-page.cc; (2) ArthurOutputDev.cc, (3) CairoOutputDev.cc, (4) GfxState.cc, (5) JBIG2Stream.cc, (6) PSOutputDev.cc, and (7) SplashOutputDev.cc in poppler/; and (8) SplashBitmap.cc, (9) Splash.cc, and (10) SplashFTFont.cc in splash/.  NOTE: this may overlap CVE-2009-0791.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-02T15:00:00.000Z
CVE-2009-3606 
Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before 3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-21T17:00:00.000Z
CVE-2009-3607 
Integer overflow in the create_surface_from_thumbnail_data function in glib/poppler-page.cc in Poppler 0.x allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-21T17:00:00.000Z
CVE-2009-3608 
Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-21T17:00:00.000Z
CVE-2009-3609 
Integer overflow in the ImageStream::ImageStream function in Stream.cc in Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, and CUPS pdftops, allows remote attackers to cause a denial of service (application crash) via a crafted PDF document that triggers a NULL pointer dereference or buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-21T17:00:00.000Z
CVE-2009-3611 
common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes certain permissions to 0777 before deleting the files in an old backup snapshot, which allows local users to obtain sensitive information by reading these files, or interfere with backup integrity by modifying files that are shared across snapshots.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-26T16:00:00.000Z
CVE-2009-3612 
The tcf_fill_node function in net/sched/cls_api.c in the netlink subsystem in the Linux kernel 2.6.x before 2.6.32-rc5, and 2.4.37.6 and earlier, does not initialize a certain tcm__pad2 structure member, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.  NOTE: this issue exists because of an incomplete fix for CVE-2005-4881.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-19T19:27:00.000Z
CVE-2009-3613 
The swiotlb functionality in the r8169 driver in drivers/net/r8169.c in the Linux kernel before 2.6.27.22 allows remote attackers to cause a denial of service (IOMMU space exhaustion and system crash) by using jumbo frames for a large amount of network traffic, as demonstrated by a flood ping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-19T19:27:00.000Z
CVE-2009-3614 
liboping 1.3.2 allows users reading arbitrary files upon the local system.
Problem types: description: Other
Affected products: vendor: liboping
product: liboping
Published: 2019-11-09T02:40:40.000Z
CVE-2009-3615 
The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and Adium before 1.3.7 allows remote attackers to cause a denial of service (application crash) via crafted contact-list data for (1) ICQ and possibly (2) AIM, as demonstrated by the SIM IM client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-20T17:00:00.000Z
CVE-2009-3616 
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-23T18:00:00.000Z
CVE-2009-3617 
Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-20T17:00:00.000Z
CVE-2009-3618 
Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the view parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-10T02:00:00.000Z
CVE-2009-3619 
Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before 1.1.2 has unknown impact and remote attack vectors related to "printing illegal parameter names and values."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-10T02:00:00.000Z
CVE-2009-3620 
The ATI Rage 128 (aka r128) driver in the Linux kernel before 2.6.31-git11 does not properly verify Concurrent Command Engine (CCE) state initialization, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via unspecified ioctl calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-22T15:26:00.000Z
CVE-2009-3621 
net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening socket, performing a shutdown operation on this socket, and then performing a series of connect operations to this socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-22T15:26:00.000Z
CVE-2009-3622 
Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a denial of service (CPU consumption and server hang) via a long title parameter in conjunction with a charset parameter composed of many comma-separated "UTF-8" substrings, related to the mb_convert_encoding function in PHP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-23T18:00:00.000Z
CVE-2009-3623 
The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 subsystem in the Linux kernel before 2.6.31.2 attempts to access a credentials cache even when a client specifies the AUTH_NULL authentication flavor, which allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via an NFSv4 mount request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-30T20:05:00.000Z
CVE-2009-3624 
The get_instantiation_keyring function in security/keys/keyctl.c in the KEYS subsystem in the Linux kernel before 2.6.32-rc5 does not properly maintain the reference count of a keyring, which allows local users to gain privileges or cause a denial of service (OOPS) via vectors involving calls to this function without specifying a keyring by ID, as demonstrated by a series of keyctl request2 and keyctl list commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-02T15:00:00.000Z
CVE-2009-3625 
Directory traversal vulnerability in www/index.php in Sahana 0.6.2.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-26T16:00:00.000Z
CVE-2009-3626 
Perl 5.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a UTF-8 character with a large, invalid codepoint, which is not properly handled during a regular-expression match.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-29T14:00:00.000Z
CVE-2009-3627 
The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-29T14:00:00.000Z