rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-1049 
Multiple SQL injection vulnerabilities in Uiga Business Portal allow remote attackers to execute arbitrary SQL commands via the (1) noentryid parameter to blog/index.php and the (2) p parameter to index2.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-22T18:17:00.000Z
CVE-2010-1050 
SQL injection vulnerability in index.php in AudiStat 1.3 allows remote attackers to execute arbitrary SQL commands via the mday parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-22T18:17:00.000Z
CVE-2010-1051 
Multiple SQL injection vulnerabilities in index.php in AudiStat 1.3 allow remote attackers to execute arbitrary SQL commands via the (1) year and (2) month parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-22T18:17:00.000Z
CVE-2010-1052 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AudiStat 1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) year and (2) mday parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-22T18:17:00.000Z
CVE-2010-1053 
Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to (a) userlogin.php and (b) managerlogin.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-22T18:17:00.000Z
CVE-2010-1054 
Multiple SQL injection vulnerabilities in ParsCMS allow remote attackers to execute arbitrary SQL commands via the RP parameter to (1) fa_default.asp and (2) en_default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1055 
Multiple PHP remote file inclusion vulnerabilities in osDate 2.1.9 and 2.5.4, when magic_quotes_gpc is disabled and register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the config[forum_installed] parameter to (1) forum/adminLogin.php and (2) forum/userLogin.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1056 
Directory traversal vulnerability in the RokDownloads (com_rokdownloads) component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1057 
Multiple directory traversal vulnerabilities in Phpkobo AdFreely (aka Ad Board Script) 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via a ..// (dot dot slash slash) in the LANG_CODE parameter to common.inc.php in (1) codelib/cfg/, (2) codelib/sys/, (3) staff/, and (4) staff/app/; and (5) staff/file.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1058 
Directory traversal vulnerability in codelib/cfg/common.inc.php in Phpkobo Address Book Script 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1059 
Directory traversal vulnerability in staff/app/common.inc.php in Phpkobo Address Book Script 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANG_CODE parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1060 
Directory traversal vulnerability in staff/app/common.inc.php in Phpkobo Short URL 1.01, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1061 
Multiple directory traversal vulnerabilities in Phpkobo Short URL 1.01, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANG_CODE parameter to (1) url/app/common.inc.php and (2) codelib/cfg/common.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1062 
Directory traversal vulnerability in codelib/sys/common.inc.php in Phpkobo Free Real Estate Contact Form 1.09, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the LANG_CODE parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1063 
Multiple directory traversal vulnerabilities in Phpkobo Free Real Estate Contact Form 1.09, when magic_quotes_gpc is disabled, allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the LANG_CODE parameter to (1) codelib/cfg/common.inc.php, (2) form/app/common.inc.php, and (3) staff/app/common.inc.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T17:00:00.000Z
CVE-2010-1064 
Erolife AjxGaleri VT stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/ajxgaleri.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1065 
Lebisoft Ziyaretci Defteri 7.4 and 7.5 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/lebisoft.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1066 
AR Web Content Manager (AWCM) 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/db_backup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1067 
E-membres 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/bdEMembres.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1068 
Multiple cross-site scripting (XSS) vulnerabilities in surgeftpmgr.cgi in NetWin SurgeFTP 2.3a6 allow remote attackers to inject arbitrary web script or HTML via the (1) domainid or (2) classid parameter in a class action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1069 
SQL injection vulnerability in games/game.php in ProArcadeScript allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1070 
SQL injection vulnerability in index.php in ImagoScripts Deviant Art Clone allows remote attackers to execute arbitrary SQL commands via the seid parameter in a forums viewcat action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1071 
SQL injection vulnerability in profil.php in phpMDJ 1.0.3 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1072 
Cross-site scripting (XSS) vulnerability in search.php in Sniggabo CMS 2.21 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1073 
SQL injection vulnerability in the jEmbed-Embed Anything (com_jembed) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a summary action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1074 
Cross-site scripting (XSS) vulnerability in the Currency Exchange module before 6.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to watchdog logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T18:00:00.000Z
CVE-2010-1075 
SQL injection vulnerability in index.php in Entry Level CMS (EL CMS) allows remote attackers to execute arbitrary SQL commands via the subj parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1076 
Cross-site scripting (XSS) vulnerability in index.php in Entry Level CMS (EL CMS) allows remote attackers to inject arbitrary web script or HTML via the subj parameter, which is not properly handled in a forced SQL error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1077 
Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the vbseourl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1078 
SQL injection vulnerability in archive.php in XlentProjects SphereCMS 1.1 alpha allows remote attackers to execute arbitrary SQL commands via encoded null bytes ("%00") in the view parameter, which bypasses a protection mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1079 
Cross-site scripting (XSS) vulnerability in Sawmill before 7.2.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1080 
Cross-site scripting (XSS) vulnerability in view.php in Pulse CMS 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the f parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1081 
Directory traversal vulnerability in the Community Polls (com_communitypolls) component 1.5.2, and possibly earlier, for Core Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1082 
Multiple directory traversal vulnerabilities in OI.Blogs 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to read arbitrary files via directory traversal sequences in the (1) theme parameter to loadStyles.php and the (2) scripts parameter to javascript/loadScripts.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-23T19:00:00.000Z
CVE-2010-1083 
The processcompl_compat function in drivers/usb/core/devio.c in Linux kernel 2.6.x through 2.6.32, and possibly other versions, does not clear the transfer buffer before returning to userspace when a USB command fails, which might make it easier for physically proximate attackers to obtain sensitive information (kernel memory).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T22:00:00.000Z
CVE-2010-1084 
Linux kernel 2.6.18 through 2.6.33, and possibly other versions, allows remote attackers to cause a denial of service (memory corruption) via a large number of Bluetooth sockets, related to the size of sysfs files in (1) net/bluetooth/l2cap.c, (2) net/bluetooth/rfcomm/core.c, (3) net/bluetooth/rfcomm/sock.c, and (4) net/bluetooth/sco.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T22:00:00.000Z
CVE-2010-1085 
The azx_position_ok function in hda_intel.c in Linux kernel 2.6.33-rc4 and earlier, when running on the AMD780V chip set, allows context-dependent attackers to cause a denial of service (crash) via unknown manipulations that trigger a divide-by-zero error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T22:00:00.000Z
CVE-2010-1086 
The ULE decapsulation functionality in drivers/media/dvb/dvb-core/dvb_net.c in dvb-core in Linux kernel 2.6.33 and earlier allows attackers to cause a denial of service (infinite loop) via a crafted MPEG2-TS frame, related to an invalid Payload Pointer ULE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T22:00:00.000Z
CVE-2010-1087 
The nfs_wait_on_request function in fs/nfs/pagelist.c in Linux kernel 2.6.x through 2.6.33-rc5 allows attackers to cause a denial of service (Oops) via unknown vectors related to truncating a file and an operation that is not interruptible.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T22:00:00.000Z
CVE-2010-1088 
fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T22:00:00.000Z
CVE-2010-1089 
SQL injection vulnerability in vedi_faq.php in PHP Trouble Ticket 2.2 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1090 
SQL injection vulnerability in index.php in phpMySite allows remote attackers to execute arbitrary SQL commands via the action parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1091 
Multiple cross-site scripting (XSS) vulnerabilities in contact.php in phpMySite allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) city, (3) email, (4) state, and (5) message parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1092 
Multiple SQL injection vulnerabilities in login.php in ScriptsFeed Business Directory Software allow remote attackers to execute arbitrary SQL commands via the (1) us and (2) ps parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1093 
SQL injection vulnerability in rss.php in 1024 CMS 2.1.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the id parameter in a vp action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1094 
SQL injection vulnerability in news.php in DZ EROTIK Auktionshaus V4rgo allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1095 
Cross-site scripting (XSS) vulnerability in login_reset_password_page.php in Tracking Requirements & Use Cases (TRUC) 0.11.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1096 
Multiple SQL injection vulnerabilities in searchmatch.php in ScriptsFeed Dating Software allow remote attackers to execute arbitrary SQL commands via the (1) txtgender and (2) txtlookgender parameters.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1097 
include/userlogin.class.php in DeDeCMS 5.5 GBK, when session.auto_start is enabled, allows remote attackers to bypass authentication and gain administrative access via a value of 1 for the _SESSION[dede_admin_id] parameter, as demonstrated by a request to uploads/include/dialog/select_soft_post.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1098 
The ANI parser in Microsoft Windows before 7 on the x86 platform, as used in Internet Explorer and other applications, allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted biClrUsed value in the BITMAPINFO header of a .ANI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T17:00:00.000Z
CVE-2010-1099 
Integer overflow in Apple Safari allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T18:00:00.000Z
CVE-2010-1100 
Integer overflow in Arora allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T18:00:00.000Z
CVE-2010-1101 
Integer overflow in Alexander Clauss iCab allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T18:00:00.000Z
CVE-2010-1102 
Integer overflow in OmniWeb allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T18:00:00.000Z
CVE-2010-1103 
Integer overflow in Stainless allows remote attackers to bypass intended port restrictions on outbound TCP connections via a port number outside the range of the unsigned short data type, as demonstrated by a value of 65561 for TCP port 25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T18:00:00.000Z
CVE-2010-1104 
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1105 
Cross-site scripting (XSS) vulnerability in cgi/index.php in AdvertisementManager 3.1.0 and 3.6 allows remote attackers to inject arbitrary web script or HTML via the usr parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1106 
PHP remote file inclusion vulnerability in cgi/index.php in AdvertisementManager 3.1.0 allows remote attackers to execute arbitrary PHP code via a URL in the req parameter.  NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1107 
Cross-site scripting (XSS) vulnerability in the Recent Comments module 5.x through 5.x-1.2 and 6.x through 6.x-1.0 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a "custom block title interface."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1108 
Cross-site scripting (XSS) vulnerability in the Control Panel module 5.x through 5.x-1.5 and 6.x through 6.x-1.2 for Drupal allows remote authenticated users, with "administer blocks" privileges, to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1109 
Multiple SQL injection vulnerabilities in index.php in phpMySport 1.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) v2 parameter in a member view action, (2) v1 parameter in a news action, (3) v1 parameter in an information action, (4) v2 parameter in a team view action, (5) v2 parameter in a club view action, or (6) v2 parameter in a matches view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1110 
Directory traversal vulnerability in index.php in phpMySport 1.4 allows remote attackers to list arbitrary directories via a .. (dot dot) in the current_folder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1111 
Multiple cross-site scripting (XSS) vulnerabilities in Jokes Complete Website allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to joke.php and the (2) searchingred parameter to results.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1112 
Cross-site scripting (XSS) vulnerability in cat.php in KloNews 2.0 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z
CVE-2010-1113 
Cross-site scripting (XSS) vulnerability in the forum page in Web Server Creator - Web Portal 0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-25T17:00:00.000Z