rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-1997 
Cross-site scripting (XSS) vulnerability in admin/edit.php in Saurus CMS 4.7.0 allows remote authenticated users, with "Article list" edit privileges, to inject arbitrary web script or HTML via the pealkiri parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-1998 
Cross-site scripting (XSS) vulnerability in the CCK TableField module 6.x before 6.x-1.2 for Drupal allows remote authenticated users, with certain node creation or editing privileges, to inject arbitrary web script or HTML via table headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-1999 
Directory traversal vulnerability in scr/soustab.php in OpenMairie Opencatalogue 1.024, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the dsn[phptype] parameter, a related issue to CVE-2007-2069.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-20007 Seagull FTP v3.3 Build 409 Stack Buffer Overflow
Seagull FTP Client <= v3.3 Build 409 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long filename, the application fails to properly validate input length, resulting in a buffer overflow that overwrites the Structured Exception Handler (SEH). This may allow remote attackers to execute arbitrary code on the client system. This product line was discontinued and users were advised to use BlueZone Secure FTP instead, at the time of disclosure.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Rocket Software
product: Seagull FTP Client
default_status: unaffected
Credits: lang: en
value: corelanc0d3r of Corelan Team
Published: 2025-08-21T20:13:54.911Z
CVE-2010-20010 Foxit PDF Reader < 4.2.0.0928 Title Stack Buffer Overflow
Foxit PDF Reader before 4.2.0.0928 does not properly bound-check the /Title entry in the PDF Info dictionary. A specially crafted PDF with an overlong Title string can overflow a fixed-size stack buffer, corrupt the Structured Exception Handler (SEH) chain, and lead to arbitrary code execution in the context of the user who opens the file.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Foxit Software
product: Foxit PDF Reader
default_status: unaffected
Credits: lang: en
value: dookie
Published: 2025-08-20T16:34:48.927Z
CVE-2010-20034 Gekko Manager FTP Client <= 0.77 Stack Buffer Overflow
Gekko Manager FTP Client <= 0.77 contains a stack-based buffer overflow in its FTP directory listing parser. When processing a server response to a LIST command, the client fails to properly validate the length of filenames. A crafted response containing an overly long filename can overwrite the Structured Exception Handler (SEH), potentially allowing remote code execution.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: New Software S.C.
product: Gekko Manager FTP Client
default_status: unaffected
Credits: lang: en
value: nullthreat
Published: 2025-08-21T20:12:22.120Z
CVE-2010-20042 Xion Audio Player ≤ 1.0.126 Unicode Stack Buffer Overflow
Xion Audio Player versions 1.0.126 and prior are vulnerable to a Unicode-based stack buffer overflow triggered by opening a specially crafted .m3u playlist file. The file contains an overly long string that overwrites the Structured Exception Handler (SEH) chain, allowing an attacker to hijack execution flow and run arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Xion
product: Audio Player
default_status: unknown
Credits: lang: en
value: hadji samir
Published: 2025-08-20T15:42:51.014Z
CVE-2010-20045 FileWrangler <= 5.30 Stack Buffer Overflow
FileWrangler <= 5.30 suffers from a stack-based buffer overflow vulnerability when parsing directory listings from an FTP server. A malicious server can send an overlong folder name in response to a LIST command, triggering memory corruption during client-side rendering. Exploitation requires passive user interaction—simply connecting to the server—without further input. Successful exploitation may lead to arbitrary code execution.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-Based Buffer Overflow
Affected products: vendor: CursorArts
product: FileWrangler
default_status: unknown
Credits: lang: en
value: nullthreat
Published: 2025-08-20T15:32:19.973Z
CVE-2010-20049 LeapFTP < 3.1.x Stack Buffer Overflow
LeapFTP < 3.1.x contains a stack-based buffer overflow vulnerability in its FTP client parser. When the client receives a directory listing containing a filename longer than 528 bytes, the application fails to properly bound-check the input and overwrites the Structured Exception Handler (SEH) chain. This allows an attacker operating a malicious FTP server to execute arbitrary code on the victim’s machine when the file is listed or downloaded.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: LeapWare
product: LeapFTP
default_status: unaffected
Credits: lang: en
value: corelanc0d3r of Corelan Team
Published: 2025-08-20T15:36:11.493Z
CVE-2010-20059 FreeNAS < 0.7.2 rev 5543 exec_raw.php Arbitrary Command Execution
FreeNAS 0.7.2 prior to revision 5543 includes an unauthenticated command‐execution backdoor in its web interface. The exec_raw.php script exposes a cmd parameter that is passed directly to the underlying shell without sanitation.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: iXsystems
product: FreeNAS
default_status: unaffected
Credits: lang: en
value: MC
Published: 2025-08-20T15:35:08.532Z
CVE-2010-20103 ProFTPD 1.3.3c Backdoor Command Execution
A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host.
Problem types: cwe_id: CWE-912
description: CWE-912 Hidden Functionality
Affected products: vendor: ProFTPD Project
product: ProFTPD (Professional FTP Daemon)
default_status: unaffected
Published: 2025-08-20T15:38:46.697Z
CVE-2010-20107 FTP Synchronizer Professional <= 4.0.73.274 Stack Buffer Overflow
A stack-based buffer overflow exists in FTP Synchronizer Professional <= v4.0.73.274. When the client connects to an FTP server and issues a LIST command—typically during sync preview or profile creation—the server’s response containing an overly long filename triggers a buffer overflow. This results in the corruption of the Structured Exception Handler (SEH), potentially allowing remote code execution.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Liuxz Software
product: FTP Synchronizer Professional
default_status: unknown
Credits: lang: en
value: myne-us
Published: 2025-08-21T20:11:09.838Z
CVE-2010-20108 FTPPad <= 1.2.0 Stack Buffer Overflow
FTPPad <= 1.2.0 contains a stack-based buffer overflow vulnerability in its FTP directory listing parser. When the client connects to an FTP server and receives a crafted response to a LIST command containing an excessively long directory and filename, the application fails to properly validate input length. This results in a buffer overflow that overwrites the saved Extended Instruction Pointer (EIP), allowing remote attackers to execute arbitrary code.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: FTPPad
product: FTPPad FTP Client
default_status: unaffected
Credits: lang: en
value: corelanc0d3r of Corelan Team
Published: 2025-08-21T20:11:33.405Z
CVE-2010-20109 Barracuda Spam & Virus Firewall "locale" Path Traversal
Barracuda products, confirmed in Spam & Virus Firewall, SSL VPN, and Web Application Firewall versions prior to October 2010, contain a path traversal vulnerability in the view_help.cgi endpoint. The locale parameter fails to properly sanitize user input, allowing attackers to inject traversal sequences and null-byte terminators to access arbitrary files on the underlying system. By exploiting this flaw, unauthenticated remote attackers can retrieve sensitive configuration files such as /mail/snapshot/config.snapshot, potentially exposing credentials, internal settings, and other critical data.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Barracuda Networks
product: Spam & Virus Firewall
default_status: unaffected
vendor: Barracuda Networks
product: SSL VPN
default_status: unaffected
vendor: Barracuda Networks
product: Web Application Firewall
default_status: unknown
Credits: lang: en
value: ShadowHatesYou
Published: 2025-08-21T20:09:03.535Z
CVE-2010-20111 Digital Music Pad <= 8.2.3.3.4 Stack Buffer Overflow
Digital Music Pad v8.2.3.3.4 contains a stack-based buffer overflow vulnerability in its playlist file parser. When opening a .pls file containing an excessively long string in the File1 field, the application fails to properly validate input length, resulting in corruption of the Structured Exception Handler (SEH) on the stack. This flaw may allow an attacker to control execution flow when the file is opened, potentially leading to arbitrary code execution.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Digital Music Pad
product: Digital Music Pad
default_status: unaffected
Credits: lang: en
value: Abhishek Lyall
Published: 2025-08-21T20:09:54.998Z
CVE-2010-20112 Amlibweb NetOpacs webquery.dll Stack Buffer Overflow
Amlib’s NetOpacs webquery.dll contains a stack-based buffer overflow vulnerability triggered by improper handling of HTTP GET parameters. Specifically, the application fails to enforce bounds on input supplied to the app parameter, allowing excessive data to overwrite memory structures including the Structured Exception Handler (SEH). Additionally, malformed parameter names followed by an equals sign may result in unintended control flow behavior. This vulnerability is exposed through IIS and affects legacy Windows deployments
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Amlib
product: Amlibweb Library Management System
default_status: unknown
Credits: lang: en
value: aushack
Published: 2025-08-21T20:08:12.350Z
CVE-2010-20113 EasyFTP Server list.html path Stack Buffer Overflow
EasyFTP Server 1.7.0.11 and earlier contains a stack-based buffer overflow vulnerability in its HTTP interface. When processing a GET request to list.html, the server fails to properly validate the length of the path parameter. Supplying an excessively long value causes a buffer overflow on the stack, potentially corrupting control flow structures. The vulnerability is exposed through the embedded web server and does not require authentication due to default anonymous access. The issue was resolved in version 1.7.0.12, after which the product was renamed to UplusFtp.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: KMiNT21 Software
product: EasyFTP Server
default_status: unaffected
Credits: lang: en
value: ThE g0bL!N
Published: 2025-08-21T20:10:42.037Z
CVE-2010-20114 VariCAD EN <= 2010-2.05 .dwb File Stack Buffer Overflow
VariCAD EN up to and including version 2010-2.05 is vulnerable to a stack-based buffer overflow when parsing .dwb drawing files. The application fails to properly validate the length of input data embedded in the file, allowing a crafted .dwb file to overwrite critical memory structures. This flaw can be exploited locally by convincing a user to open a malicious file, resulting in arbitrary code execution.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: VariCAD
product: VariCAD EN
default_status: unaffected
Credits: lang: en
value: n00b
Published: 2025-08-21T20:14:47.050Z
CVE-2010-20115 Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption
Arcane Software’s Vermillion FTP Daemon (vftpd) versions up to and including 1.31 contains a memory corruption vulnerability triggered by a malformed FTP PORT command. The flaw arises from an out-of-bounds array access during input parsing, allowing an attacker to manipulate stack memory and potentially execute arbitrary code. Exploitation requires direct access to the FTP service and is constrained by a single execution attempt if the daemon is installed as a Windows service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
cwe_id: CWE-704
description: CWE-704 Incorrect Type Conversion or Cast
Affected products: vendor: Arcane Software
product: Vermillion FTP Daemon
default_status: unaffected
Credits: lang: en
value: x4lt of Global-Evolution Security Group
Published: 2025-08-21T20:15:15.812Z
CVE-2010-20119 CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow
CommuniCrypt Mail versions up to and including 1.16 contains a stack-based buffer overflow vulnerability in its ANSMTP.dll  and AOSMTP.dll  ActiveX controls, specifically within the AddAttachments() method. This method fails to properly validate the length of input strings, allowing data to exceed the bounds of a fixed-size stack buffer. When invoked with an overly long string, the control can corrupt adjacent memory structures, including exception handlers, leading to potential control flow disruption.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: CommuniCrypt Software
product: CommuniCrypt Mail
default_status: unaffected
Credits: lang: en
value: Lincoln
Published: 2025-08-21T20:09:27.037Z
CVE-2010-20120 Maple <= v13 Maplet File Creation and Command Execution
Maple versions up to and including 13's Maplet framework allows embedded commands to be executed automatically when a .maplet file is opened. This behavior bypasses standard security restrictions that normally prevent code execution in regular Maple worksheets. The vulnerability enables attackers to craft malicious .maplet files that execute arbitrary code without user interaction.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Maplesoft
product: Maple
default_status: unaffected
Credits: lang: en
value: scriptjunkie
Published: 2025-08-21T20:12:54.367Z
CVE-2010-20121 EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer Overflow
EasyFTP Server versions up to 1.7.0.11 contain a stack-based buffer overflow vulnerability in the FTP command parser. When processing the CWD (Change Working Directory) command, the server fails to properly validate the length of the input string, allowing attackers to overwrite memory on the stack. This flaw enables remote code execution without authentication, as EasyFTP allows anonymous access by default. The vulnerability was resolved in version 1.7.0.12, after which the product was renamed “UplusFtp.”
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: KMiNT21 Software
product: EasyFTP Server
default_status: unaffected
Credits: lang: en
value: Paul Makowski
Published: 2025-08-21T20:10:20.597Z
CVE-2010-20122 Xftp FTP Client <= 3.0 PWD Response Buffer Overflow
Xftp FTP Client version up to and including 3.0 (build 0238) contain a stack-based buffer overflow vulnerability triggered by a maliciously crafted PWD response from an FTP server. When the client connects to a server and receives an overly long directory string in response to the PWD command, the client fails to properly validate the length of the input before copying it into a fixed-size buffer. This results in memory corruption and allows remote attackers to execute arbitrary code on the client system.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: NetSarang Computer, Inc.
product: Xftp FTP Client
default_status: unknown
Credits: lang: en
value: zombiefx
Published: 2025-08-21T20:16:17.595Z
CVE-2010-20123 Steinberg MyMP3Player <= 3.0.0.67 Buffer Overflow
Steinberg MyMP3Player version 3.0 (build 3.0.0.67) is vulnerable to a stack-based buffer overflow when parsing .m3u playlist files. The application fails to properly validate the length of input data within the playlist, allowing a specially crafted file to overwrite critical memory structures and execute arbitrary code. This vulnerability can be exploited locally by convincing a user to open a malicious .m3u file.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: Steinberg
product: MyMP3Player
default_status: unaffected
Credits: lang: en
value: n3w7u
Published: 2025-08-21T20:14:21.267Z
CVE-2010-2000 
Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-1358.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-2001 
Cross-site scripting (XSS) vulnerability in the CiviRegister module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-2002 
Cross-site scripting (XSS) vulnerability in the Wordfilter module 5.x before 5.x-1.1 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with "administer words filtered" privileges, to inject arbitrary web script or HTML via the word list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-2003 
Cross-site scripting (XSS) vulnerability in misc/get_admin.php in Advanced Poll 2.08 allows remote attackers to inject arbitrary web script or HTML via the mysql_host parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-2004 
Stack-based buffer overflow in BS.Global BS.Player 2.51 Build 1022 Free, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via the Skin parameter in the Options section of a skins file (.bsi), a different vulnerability than CVE-2009-1068.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T21:00:00.000Z
CVE-2010-2005 
Multiple PHP remote file inclusion vulnerabilities in DataLife Engine (DLE) 8.3 allow remote attackers to execute arbitrary PHP code via a URL in (1) the selected_language parameter to engine/inc/include/init.php, (2) the config[langs] parameter to engine/inc/help.php, (3) the config[lang] parameter to engine/ajax/pm.php, (4) and the _REQUEST[skin] parameter to engine/ajax/addcomments.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T21:00:00.000Z
CVE-2010-2006 
Directory traversal vulnerability in op/op.Login.php in LetoDMS (formerly MyDMS) 1.7.2 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T21:00:00.000Z
CVE-2010-2007 
Multiple cross-site request forgery (CSRF) vulnerabilities in LetoDMS (formerly MyDMS) 1.7.2 and earlier allow remote attackers to hijack the authentication of administrators for requests that use (1) op/op.EditUserData.php, (2) op/op.UsrMgr.php, (3) out/out.RemoveVersion.php, (4) op/op.RemoveFolder.php, (5) op/op.DefaultKeywords.php, (6) op/op.GroupMgr.php, (7) op/op.FolderAccess.php, (8) op/op.FolderNotify.php, or (9) op.MoveFolder.php in mydms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T21:00:00.000Z
CVE-2010-2008 
MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service (server crash and database loss) via an ALTER DATABASE command with a #mysql50# string followed by a . (dot), .. (dot dot), ../ (dot dot slash) or similar sequence, and an UPGRADE DATA DIRECTORY NAME command, which causes MySQL to move certain directories to the server data directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-13T20:00:00.000Z
CVE-2010-2009 
Stack-based buffer overflow in the media library in BS.Global BS.Player 2.51 build 1022, 2.41 build 1003, and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long ID3 tag in a .MP3 file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-21T17:00:00.000Z
CVE-2010-2010 
Multiple cross-site scripting (XSS) vulnerabilities in the Chaos Tool Suite (aka CTools) module 6.x before 6.x-1.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via a node title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-21T20:00:00.000Z
CVE-2010-2011 
Microsoft Dynamics GP uses a substitution cipher to encrypt the system password field and unspecified other fields, which makes it easier for remote authenticated users to obtain sensitive information by decrypting a field's contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-21T20:00:00.000Z
CVE-2010-2012 
SQL injection vulnerability in function.php in MigasCMS 1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the categorie parameter in a catalogo action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-24T17:00:00.000Z
CVE-2010-2013 
Cross-site scripting (XSS) vulnerability in cp/edit_email.php in LiSK CMS 4.4 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-24T17:00:00.000Z
CVE-2010-2014 
Cross-site scripting (XSS) vulnerability in cp/list_content.php in LiSK CMS 4.4 allows remote attackers to inject arbitrary web script or HTML via the cl or possibly id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-24T17:00:00.000Z
CVE-2010-2015 
Multiple SQL injection vulnerabilities in LiSK CMS 4.4 allow remote attackers to execute arbitrary SQL commands via (1) the id parameter in a view_inbox action to cp/cp_messages.php or (2) the id parameter to cp/edit_email.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-24T17:00:00.000Z
CVE-2010-2016 
SQL injection vulnerability in details.php in Iceberg CMS allows remote attackers to execute arbitrary SQL commands via the p_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-24T17:00:00.000Z
CVE-2010-2017 
Cross-site scripting (XSS) vulnerability in hasil-pencarian.html in Lokomedia CMS 1.4.1 and 2.0 allows remote attackers to inject arbitrary web script or HTML via the kata parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-24T17:00:00.000Z