rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-0628 
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T22:00:00.000Z
CVE-2010-0629 
Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-07T15:00:00.000Z
CVE-2010-0630 
SQL injection vulnerability in viewjokes.php in Evernew Free Joke Script 1.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0631 
Multiple SQL injection vulnerabilities in index.php in Eicra Car Rental-Script, when the plugin_id parameter is 4, allow remote attackers to execute arbitrary SQL commands via the (1) users (username) and (2) passwords parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0632 
SQL injection vulnerability in the Parkview Consultants SimpleFAQ (com_simplefaq) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a display action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0633 
Unspecified vulnerability in Citrix XenServer 5.0 Update 3 and earlier, and 5.5, allows local users to bypass authentication and execute unspecified Xen API (XAPI) calls via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0634 
Unspecified vulnerability in Fast Lexical Analyzer Generator (flex) before 2.5.35 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0635 
SQL injection vulnerability in the plgSearchEventsearch::onSearch method in eventsearch.php in the JEvents Search plugin 1.5 through 1.5.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0636 
Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php, (3) month.php, and (4) week.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0637 
Multiple cross-site request forgery (CSRF) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to hijack the authentication of administrators for requests that (1) delete an event or (2) ban an IP address from posting via unknown vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-12T22:00:00.000Z
CVE-2010-0638 
Cross-site request forgery (CSRF) vulnerability in WebCalendar 1.2.0 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-15T18:00:00.000Z
CVE-2010-0639 
The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-15T18:00:00.000Z
CVE-2010-0640 
Cross-site scripting (XSS) vulnerability in CA eHealth Performance Manager 6.0.x through 6.2.x, when malicious HTML detection is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-24T18:00:00.000Z
CVE-2010-0641 
Cross-site scripting (XSS) vulnerability in webline/html/admin/wcs/LoginPage.jhtml in Cisco Collaboration Server (CCS) 5 allows remote attackers to inject arbitrary web script or HTML via the dest parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-17T18:00:00.000Z
CVE-2010-0642 
Cisco Collaboration Server (CCS) 5 allows remote attackers to read the source code of JHTML files via URL encoded characters in the filename extension, as demonstrated by (1) changing .jhtml to %2Ejhtml, (2) changing .jhtml to .jhtm%6C, (3) appending %00 after .jhtml, and (4) appending %c0%80 after .jhtml, related to the (a) doc/docindex.jhtml, (b) browserId/wizardForm.jhtml, (c) webline/html/forms/callback.jhtml, (d) webline/html/forms/callbackICM.jhtml, (e) webline/html/agent/AgentFrame.jhtml, (f) webline/html/agent/default/badlogin.jhtml, (g) callme/callForm.jhtml, (h) webline/html/multichatui/nowDefunctWindow.jhtml, (i) browserId/wizard.jhtml, (j) admin/CiscoAdmin.jhtml, (k) msccallme/mscCallForm.jhtml, and (l) webline/html/admin/wcs/LoginPage.jhtml components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-17T18:00:00.000Z
CVE-2010-0643 
Google Chrome before 4.0.249.89 attempts to make direct connections to web sites when all configured proxy servers are unavailable, which allows remote HTTP servers to obtain potentially sensitive information about the identity of a client user via standard HTTP logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0644 
Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is configured, sends DNS queries directly, which allows remote DNS servers to obtain potentially sensitive information about the identity of a client user via request logging, as demonstrated by a proxy server that was configured for the purpose of anonymity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0645 
Multiple integer overflows in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0646 
Multiple integer signedness errors in factory.cc in Google V8 before r3560, as used in Google Chrome before 4.0.249.89, allow remote attackers to execute arbitrary code in the Chrome sandbox via crafted use of JavaScript arrays.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0647 
WebKit before r53525, as used in Google Chrome before 4.0.249.89, allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed RUBY element, as demonstrated by a <ruby>><table><rt> sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0648 
Mozilla Firefox, possibly before 3.6, allows remote attackers to discover a redirect's target URL, for the session of a specific user of a web site, by placing the site's URL in the HREF attribute of a stylesheet LINK element, and then reading the document.styleSheets[0].href property value, related to an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0649 
Integer overflow in the CrossCallParamsEx::CreateFromBuffer function in sandbox/src/crosscall_server.cc in Google Chrome before 4.0.249.89 allows attackers to leverage renderer access to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a malformed message, related to deserializing of sandbox messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0650 
WebKit, as used in Google Chrome before 4.0.249.78 and Apple Safari, allows remote attackers to bypass intended restrictions on popup windows via crafted use of a mouse click event.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0651 
WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5, permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0652 
Microsoft Internet Explorer permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote HTTP servers to obtain sensitive information via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0653 
Opera before 10.10 permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0654 
Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 permit cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive information via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0655 
Use-after-free vulnerability in Google Chrome before 4.0.249.78 allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving the display of a blocked popup window during navigation to a different web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0656 
WebKit before r51295, as used in Google Chrome before 4.0.249.78, presents a directory-listing page in response to an XMLHttpRequest for a file:/// URL that corresponds to a directory, which allows attackers to obtain sensitive information or possibly have unspecified other impact via a crafted local HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0657 
Google Chrome before 4.0.249.78 on Windows does not perform the expected encoding, escaping, and quoting for the URL in the --app argument in a desktop shortcut, which allows user-assisted remote attackers to execute arbitrary programs or obtain sensitive information by tricking a user into creating a crafted shortcut.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0658 
Multiple integer overflows in Skia, as used in Google Chrome before 4.0.249.78, allow remote attackers to execute arbitrary code in the Chrome sandbox or cause a denial of service (memory corruption and application crash) via vectors involving CANVAS elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0659 
The image decoder in WebKit before r52833, as used in Google Chrome before 4.0.249.78, does not properly handle a failure of memory allocation, which allows remote attackers to execute arbitrary code in the Chrome sandbox via a malformed GIF file that specifies a large size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0660 
Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0661 
WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit before r52401, as used in Google Chrome before 4.0.249.78, allows remote attackers to bypass the Same Origin Policy via vectors involving the window.open method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0662 
The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not use the correct variables in calculations designed to prevent integer overflows, which allows attackers to leverage renderer access to cause a denial of service or possibly have unspecified other impact via bitmap data, related to deserialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0663 
The ParamTraits<SkBitmap>::Read function in common/common_param_traits.cc in Google Chrome before 4.0.249.78 does not initialize the memory locations that will hold bitmap data, which might allow remote attackers to obtain potentially sensitive information from process memory by providing insufficient data, related to use of a (1) thumbnail database or (2) HTML canvas.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0664 
Stack consumption vulnerability in the ChildProcessSecurityPolicy::CanRequestURL function in browser/child_process_security_policy.cc in Google Chrome before 4.0.249.78 allows remote attackers to cause a denial of service (memory consumption and application crash) via a URL that specifies multiple protocols, as demonstrated by a URL that begins with many repetitions of the view-source: substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-18T17:19:00.000Z
CVE-2010-0665 
JAG (Just Another Guestbook) 1.14 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request for jag/database.sql.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-19T17:00:00.000Z
CVE-2010-0666 
Unspecified vulnerability in eMBox in Novell eDirectory 8.8 SP5 Patch 2 and earlier allows remote attackers to cause a denial of service (crash) via unknown a crafted SOAP request, a different issue than CVE-2008-0926.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-19T17:00:00.000Z
CVE-2010-0667 
MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0668 
Unspecified vulnerability in MoinMoin 1.5.x through 1.7.x, 1.8.x before 1.8.7, and 1.9.x before 1.9.2 has unknown impact and attack vectors, related to configurations that have a non-empty superuser list, the xmlrpc action enabled, the SyncPages action enabled, or OpenID configured.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0669 
MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0670 
Unspecified vulnerability in the IP-Tech JQuarks (com_jquarks) Component before 0.2.4 for Joomla! allows attackers to obtain the installation path for Joomla! via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T19:00:00.000Z
CVE-2010-0671 
SQL injection vulnerability in index.php in KR MEDIA Pogodny CMS allows remote attackers to execute arbitrary SQL commands via the id parameter in a niusy action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T20:00:00.000Z
CVE-2010-0672 
SQL injection vulnerability in index.php in WSN Guest 1.02 allows remote attackers to execute arbitrary SQL commands via the orderlinks parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T20:00:00.000Z
CVE-2010-0673 
SQL injection vulnerability in cplphoto.php in the Copperleaf Photolog plugin 0.16, and possibly earlier, for WordPress allows remote attackers to execute arbitrary SQL commands via the postid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T20:00:00.000Z
CVE-2010-0674 
StatCounteX 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for path/stats.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T20:00:00.000Z
CVE-2010-0675 
Cross-site scripting (XSS) vulnerability in index.php in BGSvetionik BGS CMS 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T20:00:00.000Z
CVE-2010-0676 
Directory traversal vulnerability in index.php in the RWCards (com_rwcards) component 3.0.18 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T20:00:00.000Z
CVE-2010-0677 
SQL injection vulnerability in index.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, allows remote attackers to execute arbitrary SQL commands via the get parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T21:00:00.000Z
CVE-2010-0678 
PHP remote file inclusion vulnerability in includes/moderation.php in Katalog Stron Hurricane 1.3.5, and possibly earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the includes_directory parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T21:00:00.000Z
CVE-2010-0679 
Multiple stack-based buffer overflows in the HyleosChemView.HLChemView ActiveX control (HyleosChemView.ocx) in Hyleos ChemView 1.9.5.1 allow remote attackers to execute arbitrary code via a large number of white space characters in the filename argument to the (1) SaveasMolFile and (2) ReadMolFile methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T21:00:00.000Z
CVE-2010-0680 
Directory traversal vulnerability in index.php in ZeusCMS 0.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T21:00:00.000Z
CVE-2010-0681 
ZeusCMS 0.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request for admin/backup.sql.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T21:00:00.000Z
CVE-2010-0682 
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct request with a modified p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0683 
Unspecified vulnerability in TIBRepoServer5.jar in TIBCO Administrator 5.4.0 through 5.6.0, when JMS transport is used, allows remote authenticated users to execute arbitrary code on all domain nodes via vectors related to leveraging administrative credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T19:00:00.000Z
CVE-2010-0684 
Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T16:00:00.000Z
CVE-2010-0685 
The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg.  NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0686 
WebAccess in VMware VirtualCenter 2.0.2 and 2.5, VMware Server 2.0, and VMware ESX 3.0.3 and 3.5 allows remote attackers to leverage proxy-server functionality to spoof the origin of requests via unspecified vectors, related to a "URL forwarding vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-01T19:00:00.000Z
CVE-2010-0688 
Stack-based buffer overflow in Orbital Viewer 1.04 allows user-assisted remote attackers to execute arbitrary code via a crafted (1) .orb or (2) .ov file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-19T20:00:00.000Z
CVE-2010-0689 
The ExecuteExe method in the DVBSExeCall Control ActiveX control 1.0.0.1 in DVBSExeCall.ocx in DATEV Base System (aka Grundpaket Basis) allows remote attackers to execute arbitrary commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z