rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-2385 
SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum (SMF) allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2386 
Insecure method vulnerability in Awingsoft Awakening Winds3D Viewer plugin 3.5.0.0, 3.0.0.5, and possibly other versions allows remote attackers to force the download and execution of arbitrary files via the GetURL method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T15:00:00.000Z
CVE-2009-2387 
Unspecified vulnerability in the proc filesystem in Sun OpenSolaris snv_49 through snv_109 allows local users to cause a denial of service (deadlock and panic) via unknown vectors, related to the ldt_rewrite_syscall function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2388 
SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtPassword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2389 
Multiple SQL injection vulnerabilities in newsscript.php in USOLVED NEWSolved 1.1.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) jahr or (2) idneu parameter in an archive action, or (3) the newsid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2390 
SQL injection vulnerability in the BookFlip (com_bookflip) component 2.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the book_id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2391 
Cross-site scripting (XSS) vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to inject arbitrary web script or HTML via the tid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2392 
SQL injection vulnerability in text.php in Virtuenetz Virtue Online Test Generator allows remote attackers to execute arbitrary SQL commands via the tid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2393 
admin/index.php in Virtuenetz Virtue Online Test Generator does not require administrative privileges, which allows remote authenticated users to have an unknown impact via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2394 
SQL injection vulnerability in cat.php in SMSPages 1.0 in Mr.Saphp Arabic Script Mobile (aka Messages Library) 2.0 allows remote attackers to execute arbitrary SQL commands via the CatID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2395 
SQL injection vulnerability in the K2 (com_k2) component 1.0.1 Beta and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the category parameter in an itemlist action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2396 
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2397 
Directory traversal vulnerability in download.php in Audio Article Directory allows remote attackers to read arbitrary files via directory traversal sequences in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2398 
Directory traversal vulnerability in test/index.php in PHP-Sugar 0.80 allows remote attackers to read arbitrary files via a ..// (dot dot slash slash) in the t parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2399 
PHP remote file inclusion vulnerability in dm-albums/template/album.php in DM FileManager 3.9.4, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2400 
SQL injection vulnerability in the PHP (com_php) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2401 
Cross-site scripting (XSS) vulnerability in PHPEcho CMS 2.0-rc3 allows remote attackers to inject arbitrary web script or HTML via a forum post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2402 
SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2403 
Heap-based buffer overflow in SCMPX 1.5.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long string in a .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2404 
Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services (NSS) before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger (AIM), allows remote SSL servers to cause a denial of service (application crash) or possibly execute arbitrary code via a long domain name in the subject's Common Name (CN) field of an X.509 certificate, related to the cert_TestHostName function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-03T14:00:00.000Z
CVE-2009-2405 
Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML via the (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled parameter to createThresholdMonitor.jsp.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-15T18:00:00.000Z
CVE-2009-2406 
Stack-based buffer overflow in the parse_tag_11_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to not ensuring that the key signature length in a Tag 11 packet is compatible with the key signature buffer size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-31T18:29:00.000Z
CVE-2009-2407 
Heap-based buffer overflow in the parse_tag_3_packet function in fs/ecryptfs/keystore.c in the eCryptfs subsystem in the Linux kernel before 2.6.30.4 allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving a crafted eCryptfs file, related to a large encrypted key size in a Tag 3 packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-31T18:29:00.000Z
CVE-2009-2408 
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T19:00:00.000Z
CVE-2009-2409 
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time.  NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T19:00:00.000Z
CVE-2009-2410 
The local_handler_callback function in server/responder/pam/pam_LOCAL_domain.c in sssd 0.4.1 does not properly handle blank-password accounts in the SSSD BE database, which allows context-dependent attackers to obtain access by sending the account's username, in conjunction with an arbitrary password, over an ssh connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-30T18:00:00.000Z
CVE-2009-2411 
Multiple integer overflows in the libsvn_delta library in Subversion before 1.5.7, and 1.6.x before 1.6.4, allow remote authenticated users and remote Subversion servers to execute arbitrary code via an svndiff stream with large windows that trigger a heap-based buffer overflow, a related issue to CVE-2009-2412.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T19:00:00.000Z
CVE-2009-2412 
Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T15:00:00.000Z
CVE-2009-2414 
Stack consumption vulnerability in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allows context-dependent attackers to cause a denial of service (application crash) via a large depth of element declarations in a DTD, related to a function recursion, as demonstrated by the Codenomicon XML fuzzing framework.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T18:00:00.000Z
CVE-2009-2415 
Multiple integer overflows in memcached 1.1.12 and 1.2.2 allow remote attackers to execute arbitrary code via vectors involving length attributes that trigger heap-based buffer overflows.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T18:00:00.000Z
CVE-2009-2416 
Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T18:00:00.000Z
CVE-2009-2417 
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2419 
Use-after-free vulnerability in the servePendingRequests function in WebCore in WebKit in Apple Safari 4.0 and 4.0.1 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted HTML document that references a zero-length .js file and the JavaScript reload function.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2420 
Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer instances) via vectors involving an unspecified HTML tag, possibly a related issue to CVE-2009-1703.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2421 
The CFCharacterSetInitInlineBuffer method in CoreFoundation.dll in Apple Safari 3.2.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via a "high-bit character" in a URL fragment for an unspecified protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T16:00:00.000Z
CVE-2009-2422 
The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T15:00:00.000Z
CVE-2009-2423 
SQL injection vulnerability in category.php in Ebay Clone 2009 allows remote attackers to execute arbitrary SQL commands via the cate_id parameter in a list action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2424 
Cross-site scripting (XSS) vulnerability in search.php in Ebay Clone 2009 allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2425 
Tor before 0.2.0.35 allows remote attackers to cause a denial of service (application crash) via a malformed router descriptor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2426 
The connection_edge_process_relay_cell_not_open function in src/or/relay.c in Tor 0.2.x before 0.2.0.35 and 0.1.x before 0.1.2.8-beta allows exit relays to have an unspecified impact by causing controllers to accept DNS responses that redirect to an internal IP address via unknown vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2427 
SQL injection vulnerability in co-profile.php in Jobbr 2.2.7 allows remote attackers to execute arbitrary SQL commands via the emp_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2428 
Multiple SQL injection vulnerabilities in Tausch Ticket Script 3 allow remote attackers to execute arbitrary SQL commands via the (1) userid parameter to suchauftraege_user.php and the (2) descr parameter to vote.php; and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2429 
SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in admin_backup.xml files and uses insecure permissions for these files, which allows local users to gain privileges.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2430 
Unspecified vulnerability in auditconfig in Sun Solaris 8, 9, 10, and OpenSolaris snv_01 through snv_58, when Solaris Auditing is enabled, allows local users with an RBAC execution profile for auditconfig to gain privileges via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T17:00:00.000Z
CVE-2009-2431 
WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T20:25:00.000Z
CVE-2009-2432 
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to wp-settings.php, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T20:25:00.000Z
CVE-2009-2433 
Stack-based buffer overflow in the AddFavorite method in Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash) and possibly have unspecified other impact via a long URL in the first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T20:25:00.000Z
CVE-2009-2434 
Buffer overflow in the syscall implementation in IBM AIX 5.3 allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2435 
The Sametime server in IBM Lotus Instant Messaging and Web Conferencing 6.5.1 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2436 
SQL injection vulnerability in page.php in Online Dating Software MyPHPDating 1.0 allows remote attackers to execute arbitrary SQL commands via the page_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2437 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Rentventory 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username (aka Login) and (2) password parameters in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2438 
Cross-site scripting (XSS) vulnerability in index.php in the search module in ClanSphere 2009.0 and 2009.0.2 allows remote attackers to inject arbitrary web script or HTML via the text parameter in a list action.  NOTE: this might overlap CVE-2008-1399.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2439 
Multiple SQL injection vulnerabilities in Web Development House Alibaba Clone allow remote attackers to execute arbitrary SQL commands via the (1) IndustryID parameter to category.php and the (2) SellerID parameter to supplier/view_contact_details.php.  NOTE: this is a product that was developed by a third party; it is not associated with alibaba.com or the Alibaba Group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2440 
Cross-site scripting (XSS) vulnerability in index.php in JNM Guestbook 3.0 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2441 
Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2442 
Cross-site scripting (XSS) vulnerability in public/index.php in Linea21 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the search parameter in a resultats-recherche action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2443 
Siteframe 3.2.3, and other 3.2.x versions, allows remote attackers to obtain configuration information via a direct request to phpinfo.php, which calls the phpinfo function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2444 
Directory traversal vulnerability in maillinglist/setup/step1.php.inc in ADbNewsSender before 1.5.6, and 2.0 before RC2, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path_to_lang parameter to setup/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T14:00:00.000Z
CVE-2009-2445 
Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T17:00:00.000Z
CVE-2009-2446 
Multiple format string vulnerabilities in the dispatch_command function in libmysqld/sql_parse.cc in mysqld in MySQL 4.0.0 through 5.0.83 allow remote authenticated users to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in a database name in a (1) COM_CREATE_DB or (2) COM_DROP_DB request.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T17:00:00.000Z
CVE-2009-2447 
Multiple cross-site scripting (XSS) vulnerabilities in ogp_show.php in Online Guestbook Pro 5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) search or (2) display parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T17:00:00.000Z
CVE-2009-2448 
Cross-site scripting (XSS) vulnerability in ogp_show.php in Online Guestbook Pro 5.1 allows remote attackers to inject arbitrary web script or HTML via the search_choice parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-13T17:00:00.000Z