rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-2239 
SQL injection vulnerability in the (1) casinobase (com_casinobase), (2) casino_blackjack (com_casino_blackjack), and (3) casino_videopoker (com_casino_videopoker) components 0.3.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2009-2240 
Cross-site scripting (XSS) vulnerability in AD2000 free-sw leger (aka Web Conference Room Free) 1.6.4 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2009-2241 
Cross-site scripting (XSS) vulnerability in search.asp in ASP Inline Corporate Calendar allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2009-2242 
SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the order parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2009-2243 
SQL injection vulnerability in active_appointments.asp in ASP Inline Corporate Calendar allows remote attackers to execute arbitrary SQL commands via the sortby parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-27T18:00:00.000Z
CVE-2009-2254 
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/sqlpatch.php, which allows remote attackers to execute arbitrary SQL commands via the query_string parameter in an execute action, in conjunction with a PATH_INFO of password_forgotten.php, related to a "SQL Execution" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2255 
Zen Cart 1.3.8a, 1.3.8, and earlier does not require administrative authentication for admin/record_company.php, which allows remote attackers to execute arbitrary code by uploading a .php file via the record_company_image parameter in conjunction with a PATH_INFO of password_forgotten.php, then accessing this file via a direct request to the file in images/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2256 
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to cause a denial of service (web outage) via an HTTP POST request to cgi-bin/firmwarecfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2257 
The administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to bypass authentication via a direct request to (1) gateway/commands/saveconfig.html, and (2) stattbl.htm, (3) modemmenu.htm, (4) onload.htm, (5) form.css, (6) utility.js, and possibly (7) indextop.htm in html/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2258 
Directory traversal vulnerability in cgi-bin/webcm in the administrative web interface on the Netgear DG632 with firmware 3.4.0_ap allows remote attackers to list arbitrary directories via a .. (dot dot) in the nextpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2260 
stardict 3.0.1, when Enable Net Dict is configured, sends the contents of the clipboard to a dictionary server, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2261 
PeaZIP 2.6.1, 2.5.1, and earlier on Windows allows user-assisted remote attackers to execute arbitrary commands via a .zip archive with a .txt file whose name contains | (pipe) characters and a command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2262 
PHP remote file inclusion vulnerability in install/di.php in AjaxPortal 3.0 allows remote attackers to execute arbitrary PHP code via a URL in the pathtoserverdata parameter.  NOTE: the installation instructions specify deleting the install/ folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2263 
Directory traversal vulnerability in index.php in Awesome PHP Mega File Manager 1.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.  NOTE: in some environments, this can be leveraged for remote file inclusion by using a UNC share pathname or an ftp, ftps, or ssh2.sftp URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-30T10:00:00.000Z
CVE-2009-2265 
Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules, as exploited in the wild for remote code execution in July 2009, related to the file browser and the editor/filemanager/connectors/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2266 
OXID eShop 4.x before 4.1.4-21266, 3.x, and 2.x allows remote attackers to obtain sensitive information (session details and order history of other users) via a crafted cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-09T17:00:00.000Z
CVE-2009-2267 
VMware Workstation 6.5.x before 6.5.3 build 185404, VMware Player 2.5.x before 2.5.3 build 185404, VMware ACE 2.5.x before 2.5.3 build 185404, VMware Server 1.x before 1.0.10 build 203137 and 2.x before 2.0.2 build 203138, VMware Fusion 2.x before 2.0.6 build 196839, VMware ESXi 3.5 and 4.0, and VMware ESX 2.5.5, 3.0.3, 3.5, and 4.0, when Virtual-8086 mode is used, do not properly set the exception code upon a page fault (aka #PF) exception, which allows guest OS users to gain privileges on the guest OS by specifying a crafted value for the cs register.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-02T15:00:00.000Z
CVE-2009-2268 
Cross-site scripting (XSS) vulnerability in the Cross-Domain Controller (CDC) servlet in Sun Java System Access Manager 6 2005Q1, 7 2005Q4, and 7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2269 
SQL injection vulnerability in Empire CMS 5.1 allows remote attackers to execute arbitrary SQL commands via the bid parameter to the default URI under e/tool/gbook/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2270 
Unrestricted file upload vulnerability in member/uploads_edit.php in dedecms 5.3 allows remote attackers to execute arbitrary code by uploading a file with a double extension in the filename, then accessing this file via unspecified vectors, as demonstrated by a .jpg.php filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2271 
The Huawei D100 has (1) a certain default administrator password for the web interface, and does not force a password change; and has (2) a default password of admin for the admin account in the telnet interface; which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2272 
The Huawei D100 stores the administrator's account name and password in cleartext in a cookie, which allows context-dependent attackers to obtain sensitive information by (1) reading a cookie file, by (2) sniffing the network for HTTP headers, and possibly by using unspecified other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2273 
The default configuration of the Wi-Fi component on the Huawei D100 does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2274 
The Huawei D100 allows remote attackers to obtain sensitive information via a direct request to (1) lan_status_adv.asp, (2) wlan_basic_cfg.asp, or (3) lancfg.asp in en/, related to use of JavaScript to protect against reading file contents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2275 
Directory traversal vulnerability in frontend/x3/stats/lastvisit.html in cPanel allows remote attackers to read arbitrary files via a .. (dot dot) in the domain parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2276 
SQL injection vulnerability in voteforus.php in the Vote For Us extension 1.0.1 and earlier for PunBB allows remote attackers to execute arbitrary SQL commands via the out parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2277 
Cross-site scripting (XSS) vulnerability in WebAccess in VMware VirtualCenter 2.0.2 and 2.5 and VMware ESX 3.0.3 and 3.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to "context data."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-01T19:00:00.000Z
CVE-2009-2281 
Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-23T18:00:00.000Z
CVE-2009-2282 
The Virtual Network Terminal Server daemon (vntsd) for Logical Domains (aka LDoms) in Sun Solaris 10, and OpenSolaris snv_41 through snv_108, on SPARC platforms does not check authorization for guest console access, which allows local control-domain users to gain guest-domain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2283 
Multiple cross-site scripting (XSS) vulnerabilities in the help jsp scripts in Sun Java Web Console 3.0.2 through 3.0.5, and Sun Java Web Console in Solaris 10, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2284 
Cross-site scripting (XSS) vulnerability in phpMyAdmin before 3.2.0.1 allows remote attackers to inject arbitrary web script or HTML via a crafted SQL bookmark.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2285 
Buffer underflow in the LZWDecodeCompat function in libtiff 3.8.2 allows context-dependent attackers to cause a denial of service (crash) via a crafted TIFF image, a different vulnerability than CVE-2008-2327.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2286 
Buffer overflow in compface 1.5.2 and earlier allows user-assisted attackers to cause a denial of service (crash) via a long declaration in a .xbm file.  NOTE: this issue only affects compface on distributions that used a certain patch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2287 
The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVM_SET_SREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfn_to_rmap function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2288 
statuswml.cgi in Nagios before 3.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) ping or (2) Traceroute parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2289 
Cross-site scripting (XSS) vulnerability in index.php in Arcade Trade Script 1.0 beta allows remote attackers to inject arbitrary web script or HTML via the q parameter in a gamelist action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2290 
SQL injection vulnerability in the Boy Scout Advancement (com_bsadv) component 0.3 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) account or (2) event task to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2291 
Unspecified vulnerability in LoginToboggan 6.x-1.x before 6.x-1.5, a module for Drupal, when "Allow users to login using their e-mail address" is enabled, allows remote blocked users to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2292 
Cross-site scripting (XSS) vulnerability in Appleple a-News 2.32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2293 
Optimum Web Design Tutorial Share 3.5.0 and earlier allows remote attackers to bypass authentication and obtain administrative access by setting the usernamed cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-01T12:26:00.000Z
CVE-2009-2294 
Integer overflow in the Png_datainfo_callback function in Dillo 2.1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PNG image with crafted (1) width or (2) height values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2295 
Multiple integer overflows in CamlImages 2.2 and earlier might allow context-dependent attackers to execute arbitrary code via a crafted PNG image with large width and height values that trigger a heap-based buffer overflow in the (1) read_png_file or (2) read_png_file_as_rgb24 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2296 
The NFSv4 server kernel module in Sun Solaris 10, and OpenSolaris before snv_119, does not properly implement the nfs_portmon setting, which allows remote attackers to access shares, and read, create, and modify arbitrary files, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2297 
Unspecified vulnerability in the udp subsystem in the kernel in Sun Solaris 10, and OpenSolaris snv_90 through snv_108, when Solaris Trusted Extensions is enabled, allows remote attackers to cause a denial of service (panic) via unspecified vectors involving the crgetlabel function, related to a "TX panic." NOTE: this issue exists because of a regression in earlier kernel patches.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2298 
Stack-based buffer overflow in rping in HP OpenView Network Node Manager (OV NNM) 7.53 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, possibly involving a CGI request to webappmon.exe.  NOTE: this may overlap CVE-2009-1420.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2299 
The Artofdefence Hyperguard Web Application Firewall (WAF) module before 2.5.5-11635, 3.0 before 3.0.3-11636, and 3.1 before 3.1.1-11637, a module for the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via an HTTP request with a large Content-Length value but no POST data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2300 
The management interface in the phion airlock Web Application Firewall (WAF) 4.1-10.41 does not properly handle CGI requests that specify large width and height parameters for an image, which allows remote attackers to execute arbitrary commands or cause a denial of service (resource consumption) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2301 
The radware AppWall Web Application Firewall (WAF) 1.0.2.6, with Gateway 4.6.0.2, allows remote attackers to read source code via a direct request to (1) funcs.inc, (2) defines.inc, or (3) msg.inc in Management/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2302 
Cross-site scripting (XSS) vulnerability in index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action. NOTE: it was later reported that 5.2.1 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2303 
index.php in Aardvark Topsites PHP 5.2.1 and earlier allows remote attackers to obtain sensitive information via a negative integer value for the start parameter in a search action, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2304 
index.php in Aardvark Topsites PHP 5.2.0 and earlier allows remote attackers to obtain sensitive information via a nonexistent account name in the u parameter in a rate action, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2305 
The ARD-9808 DVR card security camera allows remote attackers to cause a denial of service via a long URI composed of //.\ (slash slash dot backslash) sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2306 
The ARD-9808 DVR card security camera stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing usernames and passwords via a direct request for dvr.ini.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2307 
SQL injection vulnerability in the CWGuestBook module 2.1 and earlier for MAXdev MDPro (aka MD-Pro) allows remote attackers to execute arbitrary SQL commands via the rid parameter in a viewrecords action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2308 
Multiple SQL injection vulnerabilities in affiliates.php in the Affiliation (aka Affiliates) module 1.1.0 and earlier for PunBB allow remote attackers to execute arbitrary SQL commands via the (1) in or (2) out parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2309 
SQL injection vulnerability in index.php in Codice CMS 2 allows remote attackers to execute arbitrary SQL commands via the tag parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2310 
SQL injection vulnerability in include/get_read.php in Extensible-BioLawCom CMS (X-BLC) 0.2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2311 
SQL injection vulnerability in the rGallery plugin 1.2.3 for WoltLab Burning Board (WBB3) allows remote attackers to execute arbitrary SQL commands via the userID parameter in the RGalleryUserGallery page to index.php, a different vector than CVE-2008-4627.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2312 
SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in config.txt and uses insecure permissions for this file, which allows local users to gain privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2313 
Directory traversal vulnerability in index.php in Jinzora Media Jukebox 2.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-02T10:00:00.000Z
CVE-2009-2314 
Race condition in the Sun Lightweight Availability Collection Tool 3.0 on Solaris 7 through 10 allows local users to overwrite arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2316 
Multiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0 allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in (1) the self-service UI interface or (2) the console interface. NOTE: it was later reported that 4.6.0 is also affected by the first vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2317 
The Axesstel MV 410R has a certain default administrator password, and does not force a password change, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2318 
The Axesstel MV 410R allows remote attackers to cause a denial of service via a flood of SYN packets, a related issue to CVE-1999-0116.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2319 
The default configuration of the Wi-Fi component on the Axesstel MV 410R does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2320 
The web interface on the Axesstel MV 410R relies on client-side JavaScript code to validate input, which allows remote attackers to send crafted data, and possibly have unspecified other impact, via a client that does not process JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z