rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-5022 
Heap-based buffer overflow in tif_ojpeg.c in the OJPEG decoder in LibTIFF before 3.9.5 allows remote attackers to execute arbitrary code via a crafted TIFF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-03T20:00:00.000Z
CVE-2009-5023 
The (1) dshield.conf, (2) mail-buffered.conf, (3) mynetwatchman.conf, and (4) mynetwatchman.conf actions in action.d/ in Fail2ban before 0.8.5 allows local users to write to arbitrary files via a symlink attack on temporary files with predictable names, as demonstrated by /tmp/fail2ban-mail.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-10T14:00:00.000Z
CVE-2009-5024 
ViewVC before 1.1.11 allows remote attackers to bypass the cvsdb row_limit configuration setting, and consequently conduct resource-consumption attacks, via the limit parameter, as demonstrated by a "query revision history" request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-23T22:00:00.000Z
CVE-2009-5025 
A backdoor (aka BMSA-2009-07) was found in PyForum v1.0.3 where an attacker who knows a valid user email could force a password reset on behalf of that user.
Problem types: description: Other
Affected products: vendor: PyForum
product: PyForum
Published: 2020-01-15T20:15:34.000Z
CVE-2009-5026 
The executable comment feature in MySQL 5.0.x before 5.0.93 and 5.1.x before 5.1.50, when running in certain slave configurations in which the slave is running a newer version than the master, allows remote attackers to execute arbitrary SQL commands via custom comments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T00:00:00.000Z
CVE-2009-5028 
Stack-based buffer overflow in Namazu before 2.0.20 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted request containing an empty uri field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T02:00:00.000Z
CVE-2009-5029 
Integer overflow in the __tzfile_read function in glibc before 2.15 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted timezone (TZ) file, as demonstrated using vsftpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2009-5030 
The tcd_free_encode function in tcd.c in OpenJPEG 1.3 through 1.5 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted tile information in a Gray16 TIFF image, which causes insufficient memory to be allocated and leads to an "invalid free."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-18T22:00:00.000Z
CVE-2009-5031 
ModSecurity before 2.5.11 treats request parameter values containing single quotes as files, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks via a single quote in a request parameter in the Content-Disposition field of a request with a multipart/form-data Content-Type header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T16:00:00.000Z
CVE-2009-5032 
The encrypted e-mail feature in IBM Lotus Notes Traveler before 8.5.0.2 sends unencrypted messages when the feature is used without uploading a Notes ID file, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:45:00.000Z
CVE-2009-5033 
IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle a "* *" argument sequence for a certain tell command, which allows remote authenticated users to obtain access to other users' data via a sync operation, related to storage of the data of multiple users within the same thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:45:00.000Z
CVE-2009-5034 
IBM Lotus Notes Traveler before 8.5.0.2 allows remote authenticated users to cause a denial of service (memory consumption and daemon crash) by syncing a large volume of data, related to the launch of a new process to handle the data while the previous process is still operating on the data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:45:00.000Z
CVE-2009-5035 
The Nokia client in IBM Lotus Notes Traveler before 8.5.0.2 does not properly handle multiple outgoing e-mail messages between sync operations, which might allow remote attackers to read communications intended for other recipients by examining appended messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:45:00.000Z
CVE-2009-5036 
traveler.exe in IBM Lotus Notes Traveler before 8.0.1.3 CF1 allows remote authenticated users to cause a denial of service (daemon crash) via a malformed invitation document in a sync operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:45:00.000Z
CVE-2009-5037 
Cisco Adaptive Security Appliances (ASA) 5500 series devices with software before 8.2(3) allow remote attackers to cause a denial of service (ASDM syslog outage) via a long URL, aka Bug IDs CSCsm11264 and CSCtb92911.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-07T11:00:00.000Z
CVE-2009-5038 
Cisco IOS before 15.0(1)XA does not properly handle IRC traffic during a specific time period after an initial reload, which allows remote attackers to cause a denial of service (device reload) via an attempted connection to a certain IRC server, related to a "corrupted magic value," aka Bug ID CSCso05336.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-07T18:00:00.000Z
CVE-2009-5039 
Memory leak in the gk_circuit_info_do_in_acf function in the H.323 implementation in Cisco IOS before 15.0(1)XA allows remote attackers to cause a denial of service (memory consumption) via a large number of calls over a long duration, as demonstrated by InterZone Clear Token (IZCT) test traffic, aka Bug ID CSCsz72535.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-07T18:00:00.000Z
CVE-2009-5040 
CallManager Express (CME) on Cisco IOS before 15.0(1)XA allows remote authenticated users to cause a denial of service (device crash) by using an extension mobility (EM) phone to interact with the menu for SNR number changes, aka Bug ID CSCta63555.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-07T18:00:00.000Z
CVE-2009-5041 
overkill has buffer overflow via long player names that can corrupt data on the server machine
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:35:27.000Z
CVE-2009-5042 
python-docutils allows insecure usage of temporary files
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:40:22.000Z
CVE-2009-5043 
burn allows file names to escape via mishandled quotation marks
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:28:37.000Z
CVE-2009-5044 
contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 allows local users to overwrite arbitrary files via a symlink attack on a pdf#####.tmp temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-24T20:00:00.000Z
CVE-2009-5045 
Dump Servlet information leak in jetty before 6.1.22.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T19:51:28.000Z
CVE-2009-5046 
JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T19:57:15.000Z
CVE-2009-5048 
Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T18:35:11.000Z
CVE-2009-5049 
WebApp JSP Snoop page XSS in jetty though 6.1.21.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T18:46:12.000Z
CVE-2009-5050 
konversation before 1.2.3 allows attackers to cause a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-06T18:58:28.000Z
CVE-2009-5051 
Hastymail2 before RC 8 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-18T17:00:00.000Z
CVE-2009-5052 
Multiple unspecified vulnerabilities in Smarty before 3.0.0 beta 6 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-03T16:00:00.000Z
CVE-2009-5053 
Unspecified vulnerability in Smarty before 3.0.0 beta 6 allows remote attackers to execute arbitrary PHP code by injecting this code into a cache file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-03T16:00:00.000Z
CVE-2009-5054 
Smarty before 3.0.0 beta 4 does not consider the umask value when setting the permissions of files, which might allow attackers to bypass intended access restrictions via standard filesystem operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-03T16:00:00.000Z
CVE-2009-5055 
Open Ticket Request System (OTRS) before 2.4.4 grants ticket access on the basis of single-digit substrings of the CustomerID value, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by visiting a ticket, as demonstrated by leveraging the CustomerID 12 account to read tickets that should be available only to CustomerID 1 or CustomerID 2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2009-5056 
Open Ticket Request System (OTRS) before 2.4.0-beta2 does not properly enforce the move_into permission setting for a queue, which allows remote authenticated users to bypass intended access restrictions and read a ticket by watching this ticket, and then selecting the ticket from the watched-tickets list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2009-5057 
The S/MIME feature in Open Ticket Request System (OTRS) before 2.3.4 does not configure the RANDFILE and HOME environment variables for OpenSSL, which might make it easier for remote attackers to decrypt e-mail messages that had lower than intended entropy available for cryptographic operations, related to inability to write to the seeding file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-18T16:00:00.000Z
CVE-2009-5058 
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.5 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by deleting an item that is accessed through a connector, aka SPR RELS7LARKR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2009-5059 
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.10 services for Lotus Domino might allow remote authenticated users to cause a denial of service (daemon crash) by checking out a document that is accessed through a connector, aka SPR MMOI7PSR8J.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2009-5060 
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.11 services for Lotus Domino might allow remote authenticated users to cause a denial of service (daemon crash) by accessing an entry in a calendar, aka SPR MZHA7SEBJX.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2009-5061 
Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.14 services for Lotus Domino, when Domino Native Authentication is enabled, might allow remote authenticated users to cause a denial of service (daemon crash) by going offline, aka SPR MLZG7UPB9N.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2009-5062 
IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service (daemon crash) by subscribing to an Atom feed, aka SPR JRIE7VKMP9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2009-5063 
Memory leak in the embedded_profile_len function in pngwutil.c in libpng before 1.2.39beta5 allows context-dependent attackers to cause a denial of service (memory leak or segmentation fault) via a JPEG image containing an iCCP chunk with a negative embedded profile length.  NOTE: this is due to an incomplete fix for CVE-2006-7244.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-31T23:00:00.000Z
CVE-2009-5064 
ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks.  NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-30T22:00:00.000Z
CVE-2009-5065 
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-11T18:00:00.000Z
CVE-2009-5066 
twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T20:00:00.000Z
CVE-2009-5067 
Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive.  NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2009-5068 
There is a file disclosure vulnerability in SMF (Simple Machines Forum) affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesystem and therefore gain new privileges by reading the settings.php with the database passwords.
Problem types: description: file disclosure
Affected products: vendor: SMF
product: SMF
Published: 2020-01-15T20:27:08.000Z
CVE-2009-5071 
Unspecified vulnerability in Palm Pre WebOS before 1.2.1 has unknown impact and attack vectors related to an "included contact template file."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-19T19:00:00.000Z
CVE-2009-5072 
Memory leak in the ldap_explode_dn function in IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.61 (aka 6.0.0.8-TIV-ITDS-IF0003) allows remote authenticated users to cause a denial of service (memory consumption) via an empty string argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2009-5073 
IBM Tivoli Directory Server (TDS) 6.0 before 6.0.0.59 (aka 6.0.0.8-TIV-ITDS-IF0001) allows remote authenticated users to cause a denial of service (infinite loop and daemon hang) by adding a nested group that contains the Distinguished Name (DN) of its parent entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-21T10:00:00.000Z
CVE-2009-5074 
Unspecified vulnerability in the MojoX::Dispatcher::Static implementation in Mojolicious before 0.991250 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-03T00:03:00.000Z
CVE-2009-5075 
Monkey's Audio before 4.02 allows remote attackers to cause a denial of service (application crash) via a malformed APE file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-20T22:00:00.000Z
CVE-2009-5076 
CRE Loaded before 6.2.14, and possibly other versions before 6.3.x, allows remote attackers to bypass authentication and gain administrator privileges via a request with (1) login.php or (2) password_forgotten.php appended as the PATH_INFO, which bypasses a check that uses PHP_SELF, which is not properly handled by (a) includes/application_top.php and (b) admin/includes/application_top.php, as exploited in the wild in 2009.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-08T10:00:00.000Z
CVE-2009-5077 
CRE Loaded before 6.2.14 allows remote attackers to bypass authentication and gain administrator privileges via vectors related to a modified PHP_SELF variable, which is not properly handled by (1) includes/application_top.php and (2) admin/includes/application_top.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-08T15:00:00.000Z
CVE-2009-5078 
contrib/pdfmark/pdfroff.sh in GNU troff (aka groff) before 1.21 launches the Ghostscript program without the -dSAFER option, which allows remote attackers to create, overwrite, rename, or delete arbitrary files via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-30T15:26:00.000Z
CVE-2009-5079 
The (1) gendef.sh, (2) doc/fixinfo.sh, and (3) contrib/gdiffmk/tests/runtests.in scripts in GNU troff (aka groff) 1.21 and earlier allow local users to overwrite arbitrary files via a symlink attack on a gro#####.tmp or /tmp/##### temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-30T15:26:00.000Z
CVE-2009-5080 
The (1) contrib/eqn2graph/eqn2graph.sh, (2) contrib/grap2graph/grap2graph.sh, and (3) contrib/pic2graph/pic2graph.sh scripts in GNU troff (aka groff) 1.21 and earlier do not properly handle certain failed attempts to create temporary directories, which might allow local users to overwrite arbitrary files via a symlink attack on a file in a temporary directory, a different vulnerability than CVE-2004-1296.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-30T15:26:00.000Z
CVE-2009-5081 
The (1) config.guess, (2) contrib/groffer/perl/groffer.pl, and (3) contrib/groffer/perl/roff2.pl scripts in GNU troff (aka groff) 1.21 and earlier use an insufficient number of X characters in the template argument to the tempfile function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file, a different vulnerability than CVE-2004-0969.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-30T15:26:00.000Z
CVE-2009-5082 
The (1) configure and (2) config.guess scripts in GNU troff (aka groff) 1.20.1 on Openwall GNU/*/Linux (aka Owl) improperly create temporary files upon a failure of the mktemp function, which makes it easier for local users to overwrite arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-30T15:26:00.000Z
CVE-2009-5083 
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-12T17:00:00.000Z
CVE-2009-5084 
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the log data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-12T17:00:00.000Z
CVE-2009-5085 
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions via vectors that trigger absence of the consent-to-authenticate page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-12T17:00:00.000Z
CVE-2009-5086 
Cross-site scripting (XSS) vulnerability in Appliance Configuration Manager (ACM) in Juniper IDP 4.1 before 4.1r3 and 4.2 before 4.2r1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-02T17:00:00.000Z
CVE-2009-5087 
Directory traversal vulnerability in geohttpserver in Geovision Digital Video Surveillance System 8.2 allows remote attackers to read arbitrary files via a .. (dot dot) in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5088 
SQL injection vulnerability in secure/index.php in IdeaCart 0.02 allows remote attackers to execute arbitrary SQL commands via the cID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5089 
Directory traversal vulnerability in index.php in IdeaCart 0.02 and 0.02a allows remote attackers to read arbitrary files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5090 
SQL injection vulnerability in editcomments.php in Bloggeruniverse Beta 2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter and possibly other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5091 
SQL injection vulnerability in page.php in Vlinks 1.0.3 and 1.1.6 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5092 
Cross-site scripting (XSS) vulnerability in the management interface in Microsoft FAST ESP 5.1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z