rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-0754 
PHP 4.4.4, 5.1.6, and other versions, when running on Apache, allows local users to modify behavior of other sites hosted on the same web server by modifying the mbstring.func_overload setting within .htaccess, which causes this setting to be applied to other virtual hosts on the same server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T16:00:00.000Z
CVE-2009-0755 
The FormWidgetChoice::loadDefaults function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file with an invalid Form Opt entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T16:00:00.000Z
CVE-2009-0756 
The JBIG2Stream::readSymbolDictSeg function in Poppler before 0.10.4 allows remote attackers to cause a denial of service (crash) via a PDF file that triggers a parsing error, which is not properly handled by JBIG2SymbolDict::~JBIG2SymbolDict and triggers an invalid memory dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T16:00:00.000Z
CVE-2009-0757 
Multiple buffer overflows in GNU MPFR 2.4.0 allow context-dependent attackers to cause a denial of service (crash) via the (1) mpfr_snprintf and (2) mpfr_vsnprintf functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T16:00:00.000Z
CVE-2009-0758 
The originates_from_local_legacy_unicast_socket function in avahi-core/server.c in avahi-daemon 0.6.23 does not account for the network byte order of a port number when processing incoming multicast packets, which allows remote attackers to cause a denial of service (network bandwidth and CPU consumption) via a crafted legacy unicast mDNS query packet that triggers a multicast packet storm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T16:00:00.000Z
CVE-2009-0759 
Multiple CRLF injection vulnerabilities in webadmin in ZNC before 0.066 allow remote authenticated users to modify the znc.conf configuration file and gain privileges via CRLF sequences in the quit message and other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T16:00:00.000Z
CVE-2009-0760 
Team Board 1.x and 2.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for data/team.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0761 
Cross-site scripting (XSS) vulnerability in online.asp in Team Board 1.x allows remote attackers to inject arbitrary web script or HTML via the lookname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0762 
Cross-site scripting (XSS) vulnerability in ScriptsEz Ez PHP Comment allows remote attackers to inject arbitrary web script or HTML via the name parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0763 
Cross-site scripting (XSS) vulnerability in default.php in Kipper 2.01 allows remote attackers to inject arbitrary web script or HTML via the charm parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0764 
Multiple cross-site scripting (XSS) vulnerabilities in Kipper 2.01 allow remote attackers to inject arbitrary web script or HTML via the charm parameter to (1) index.php and (2) kipper.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0765 
Directory traversal vulnerability in index.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the configfile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0766 
Directory traversal vulnerability in default.php in Kipper 2.01 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the configfile parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0767 
Kipper 2.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing credentials via a direct request for job/config.data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0768 
SQL injection vulnerability in forumhop.php in YapBB 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the forumID parameter in a next action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0769 
QIP 2005 build 8082 allows remote attackers to cause a denial of service (CPU consumption and application hang) via a crafted Rich Text Format (RTF) ICQ message, as demonstrated by an {\rtf\pict\&&} message.  NOTE: the vulnerability may be in Sergey Tkachenko TRichView. If so, then this should not be treated as a vulnerability in QIP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0770 
dkim-milter 2.6.0 through 2.8.0 allows remote attackers to cause a denial of service (crash) by signing a message with a key that has been revoked in DNS, which triggers an assertion error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-03T18:00:00.000Z
CVE-2009-0771 
The layout engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via certain vectors that trigger memory corruption and assertion failures.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0772 
The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to nsCSSStyleSheet::GetOwnerNode, events, and garbage collection, which triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0773 
The JavaScript engine in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a splice of an array that contains "some non-set elements," which causes jsarray.cpp to pass an incorrect argument to the ResizeSlots function, which triggers memory corruption; (2) vectors related to js_DecompileValueGenerator, jsopcode.cpp, __defineSetter__, and watch, which triggers an assertion failure or a segmentation fault; and (3) vectors related to gczeal, __defineSetter__, and watch, which triggers a hang.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0774 
The layout engine in Mozilla Firefox 2 and 3 before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey 1.1.15 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to gczeal, a different vulnerability than CVE-2009-0773.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0775 
Double free vulnerability in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to execute arbitrary code via "cloned XUL DOM elements which were linked as a parent and child," which are not properly handled during garbage collection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0776 
nsIRDFService in Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 allows remote attackers to bypass the same-origin policy and read XML data from another domain via a cross-domain redirect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0777 
Mozilla Firefox before 3.0.7, Thunderbird before 2.0.0.21, and SeaMonkey before 1.1.15 decode invisible characters when they are displayed in the location bar, which causes an incorrect address to be displayed and makes it easier for remote attackers to spoof URLs and conduct phishing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0778 
The icmp_send function in net/ipv4/icmp.c in the Linux kernel before 2.6.25, when configured as a router with a REJECT route, does not properly manage the Protocol Independent Destination Cache (aka DST) in some situations involving transmission of an ICMP Host Unreachable message, which allows remote attackers to cause a denial of service (connectivity outage) by sending a large series of packets to many destination IP addresses within this REJECT route, related to an "rt_cache leak."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-12T15:00:00.000Z
CVE-2009-0779 
Buffer overflow in pppdial in IBM AIX 5.3 and 6.1 allows local users to gain privileges via a long "input string."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T11:00:00.000Z
CVE-2009-0780 
The aspath_prepend function in rde_attr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T11:00:00.000Z
CVE-2009-0781 
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-09T21:00:00.000Z
CVE-2009-0783 
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-05T15:25:00.000Z
CVE-2009-0784 
Race condition in the SystemTap stap tool 0.0.20080705 and 0.0.20090314 allows local users in the stapusr group to insert arbitrary SystemTap kernel modules and gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T23:00:00.000Z
CVE-2009-0787 
The ecryptfs_write_metadata_to_contents function in the eCryptfs functionality in the Linux kernel 2.6.28 before 2.6.28.9 uses an incorrect size when writing kernel memory to an eCryptfs file header, which triggers an out-of-bounds read and allows local users to obtain portions of kernel memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-25T01:00:00.000Z
CVE-2009-0788 
Red Hat Network (RHN) Satellite Server 5.3 and 5.4 does not properly rewrite unspecified URLs, which allows remote attackers to (1) obtain unspecified sensitive host information or (2) use the server as an inadvertent proxy to connect to arbitrary services and IP addresses via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-18T17:00:00.000Z
CVE-2009-0789 
OpenSSL before 0.9.8k on WIN64 and certain other platforms does not properly handle a malformed ASN.1 structure, which allows remote attackers to cause a denial of service (invalid memory access and application crash) by placing this structure in the public key of a certificate, as demonstrated by an RSA public key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-27T16:00:00.000Z
CVE-2009-0790 
The pluto IKE daemon in Openswan and Strongswan IPsec 2.6 before 2.6.21 and 2.4 before 2.4.14, and Strongswan 4.2 before 4.2.14 and 2.8 before 2.8.9, allows remote attackers to cause a denial of service (daemon crash and restart) via a crafted (1) R_U_THERE or (2) R_U_THERE_ACK Dead Peer Detection (DPD) IPsec IKE Notification message that triggers a NULL pointer dereference related to inconsistent ISAKMP state and the lack of a phase2 state association in DPD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-01T10:00:00.000Z
CVE-2009-0791 
Multiple integer overflows in Xpdf 2.x and 3.x and Poppler 0.x, as used in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7, GPdf, and kdegraphics KPDF, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3) gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-09T17:00:00.000Z
CVE-2009-0792 
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.  NOTE: this issue exists because of an incomplete fix for CVE-2009-0583.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-14T16:00:00.000Z
CVE-2009-0793 
cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-09T15:00:00.000Z
CVE-2009-0794 
Integer overflow in the PulseAudioTargetDataL class in src/java/org/classpath/icedtea/pulseaudio/PulseAudioTargetDataLine.java in Pulse-Java, as used in OpenJDK 1.6.0.0 and other products, allows remote attackers to cause a denial of service (applet crash) via a crafted Pulse Audio source data line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-13T16:00:00.000Z
CVE-2009-0796 
Cross-site scripting (XSS) vulnerability in Status.pm in Apache::Status and Apache2::Status in mod_perl1 and mod_perl2 for the Apache HTTP Server, when /perl-status is accessible, allows remote attackers to inject arbitrary web script or HTML via the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-07T23:00:00.000Z
CVE-2009-0798 
ACPI Event Daemon (acpid) before 1.0.10 allows remote attackers to cause a denial of service (CPU consumption and connectivity loss) by opening a large number of UNIX sockets without closing them, which triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-24T15:00:00.000Z
CVE-2009-0799 
The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-23T17:00:00.000Z
CVE-2009-0800 
Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-23T17:00:00.000Z
CVE-2009-0801 
Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T16:00:00.000Z
CVE-2009-0802 
Qbik WinGate, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T16:00:00.000Z
CVE-2009-0803 
SmoothWall SmoothGuardian, as used in SmoothWall Firewall, NetworkGuardian, and SchoolGuardian 2008, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T16:00:00.000Z
CVE-2009-0804 
Ziproxy 2.6.0, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which allows remote attackers to bypass access controls for Flash, Java, Silverlight, and probably other technologies, and possibly communicate with restricted intranet sites, via a crafted web page that causes a client to send HTTP requests with a modified Host header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T16:00:00.000Z
CVE-2009-0805 
Cross-site scripting (XSS) vulnerability in piCal 0.91h and earlier, a module for XOOPS, allows remote attackers to inject arbitrary web script or HTML via the event_id parameter in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0806 
Unspecified vulnerability in OpenGoo before 1.2.1 allows remote authenticated users to modify their own permissions via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0807 
zFeeder 1.6 allows remote attackers to gain administrative access via a direct request to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0808 
Multiple SQL injection vulnerabilities in SimpleCMMS before 0.1.0 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0809 
The Web Editor in Dassault Systemes ENOVIA SmarTeam V5 before Release 18 Service Pack 8, and possibly CATIA and other products, allows remote authenticated users to read the profile card of an object in the document class via a link that is sent from the owner of the document object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0810 
SQL injection vulnerability in login.php in xGuestbook 2.0 allows remote attackers to execute arbitrary SQL commands via the user parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0811 
Insecure method vulnerability in the SopCast SopCore ActiveX control in sopocx.ocx 3.0.3.501 allows remote attackers to execute arbitrary programs via an executable file name in the argument to the SetExternalPlayer method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0812 
Stack-based buffer overflow in BreakPoint Software Hex Workshop 4.23, 6.0.1.4603, and other 6.x and earlier versions allows remote attackers to execute arbitrary code via a crafted Intel Hex Code (.hex) file. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-04T17:00:00.000Z
CVE-2009-0813 
Insecure method vulnerability in the ImeraIEPlugin ActiveX control (ImeraIEPlugin.dll 1.0.2.54) in Imera TeamLinks Client allows remote attackers to force the download and execution of arbitrary URLs via modified DownloadProtocol, DownloadHost, DownloadPort, and DownloadURI parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0814 
Cross-site scripting (XSS) vulnerability in Widgets.aspx in Blogsa 1.0 Beta 3 and earlier allows remote attackers to inject arbitrary web script or HTML via the searchText parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0815 
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0816 
Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0817 
Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z