rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-2883 
SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the cp_username parameter, related to an error in the CleanVar function in includes/functions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2884 
Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to inject arbitrary web script or HTML via the rank parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2885 
SQL injection vulnerability in bios.php in PHP Scripts Now World's Tallest Buildings allows remote attackers to execute arbitrary SQL commands via the rank parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2886 
SQL injection vulnerability in bios.php in PHP Scripts Now President Bios allows remote attackers to execute arbitrary SQL commands via the rank parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2887 
Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts Now President Bios allows remote attackers to inject arbitrary web script or HTML via the rank parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2888 
SQL injection vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to execute arbitrary SQL commands via the n parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2889 
Cross-site scripting (XSS) vulnerability in index.php in PHP Scripts Now Hangman allows remote attackers to inject arbitrary web script or HTML via the letters parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2890 
Cross-site scripting (XSS) vulnerability in results.php in PHP Scripts Now Riddles allows remote attackers to inject arbitrary web script or HTML via the searchquery parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2891 
SQL injection vulnerability in list.php in PHP Scripts Now Riddles allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2892 
Multiple SQL injection vulnerabilities in header.php in Scripteen Free Image Hosting Script 2.3 allow remote attackers to execute arbitrary SQL commands via a (1) cookid or (2) cookgid cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2893 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in XZero Community Classifieds 4.97.8 allow remote attackers to inject arbitrary web script or HTML via (1) the postevent parameter in a post action or (2) the _xzcal_y parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2894 
Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to product_desc.php, and the cid parameter to (2) showcategory.php and (3) gallery.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2895 
SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate (URA) 3.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2896 
Buffer overflow in KMplayer 2.9.4.1433 and earlier allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long string in a subtitle (.srt) playlist file. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T17:00:00.000Z
CVE-2009-2897 
Multiple cross-site scripting (XSS) vulnerabilities in hq/web/common/GenericError.jsp in the generic exception handler in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allow remote attackers to inject arbitrary web script or HTML via invalid values for numerical parameters, as demonstrated by an uncaught java.lang.NumberFormatException exception resulting from (1) the typeId parameter to mastheadAttach.do, (2) the eid parameter to Resource.do, and (3) the u parameter in a view action to admin/user/UserAdmin.do.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-2898 
Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-2899 
The monitor perl script in the Sybase database plug-in in SpringSource Hyperic HQ before 4.3 allows local users to obtain the database password by listing the process and its arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T17:00:00.000Z
CVE-2009-2901 
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-28T20:00:00.000Z
CVE-2009-2902 
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-28T20:00:00.000Z
CVE-2009-2903 
Memory leak in the appletalk subsystem in the Linux kernel 2.4.x through 2.4.37.6 and 2.6.x through 2.6.31, when the appletalk and ipddp modules are loaded but the ipddp"N" device is not found, allows remote attackers to cause a denial of service (memory consumption) via IP-DDP datagrams.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T22:00:00.000Z
CVE-2009-2904 
A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-01T15:00:00.000Z
CVE-2009-2905 
Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and 0.52.2 allows local users to cause a denial of service (application crash) or possibly execute arbitrary code via a request to display a crafted text dialog box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T19:00:00.000Z
CVE-2009-2906 
smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, and 3.4 before 3.4.2 allows remote authenticated users to cause a denial of service (infinite loop) via an unanticipated oplock break notification reply packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-07T18:00:00.000Z
CVE-2009-2907 
Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-24T18:00:00.000Z
CVE-2009-2908 
The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux kernel 2.6.31 allows local users to cause a denial of service (kernel OOPS) and possibly execute arbitrary code via unspecified vectors that cause a "negative dentry" and trigger a NULL pointer dereference, as demonstrated via a Mutt temporary directory in an eCryptfs mount.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-2909 
Integer signedness error in the ax25_setsockopt function in net/ax25/af_ax25.c in the ax25 subsystem in the Linux kernel before 2.6.31.2 allows local users to cause a denial of service (OOPS) via a crafted optlen value in an SO_BINDTODEVICE operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-20T17:00:00.000Z
CVE-2009-2910 
arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the x86_64 platform does not clear certain kernel registers before a return to user mode, which allows local users to read register values from an earlier process by switching an ia32 process to 64-bit mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-20T17:00:00.000Z
CVE-2009-2911 
SystemTap 1.0, when the --unprivileged option is used, does not properly restrict certain data sizes, which allows local users to (1) cause a denial of service or gain privileges via a print operation with a large number of arguments that trigger a kernel stack overflow, (2) cause a denial of service via crafted DWARF expressions that trigger a kernel stack frame overflow, or (3) cause a denial of service (infinite loop) via vectors that trigger creation of large unwind tables, related to Common Information Entry (CIE) and Call Frame Instruction (CFI) records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-22T16:00:00.000Z
CVE-2009-2912 
The (1) sendfile and (2) sendfilev functions in Sun Solaris 8 through 10, and OpenSolaris before snv_110, allow local users to cause a denial of service (panic) via vectors related to vnode function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T22:00:00.000Z
CVE-2009-2913 
Cross-site scripting (XSS) vulnerability in index.php in XZero Community Classifieds 4.97.8 allows remote attackers to inject arbitrary web script or HTML via the URI.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T22:00:00.000Z
CVE-2009-2914 
Cross-site scripting (XSS) vulnerability in index.php in XZero Community Classifieds 4.97.8 and earlier allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T22:00:00.000Z
CVE-2009-2915 
SQL injection vulnerability in 2fly_gift.php in 2FLY Gift Delivery System 6.0 allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a content action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2916 
Format string vulnerability in the CNS_AddTxt function in logs.dll in 2K Games Vietcong 2 1.10 and earlier might allow remote attackers to execute arbitrary code via format string specifiers in the nickname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2917 
Stack-based buffer overflow in ImTOO MPEG Encoder 3.1.53 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted string in a (1) .cue or (2) .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2918 
The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted request to the 0x80000034 IOCTL, probably involving an input or output buffer size of 0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2919 
Cross-site scripting (XSS) vulnerability in Boonex Orca 2.0 and 2.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the topic title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2920 
Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) component and (2) priority parameters to buglist.php; and the (3) Username (4) E-mail, (5) Pass, and (6) Confirm pass fields to createaccount.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2921 
Multiple SQL injection vulnerabilities in login.php in MOC Designs PHP News 1.1 allow remote attackers to execute arbitrary SQL commands via the (1) newsuser parameter (User field) and (2) newspassword parameter (Password field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2922 
Absolute path traversal vulnerability in pixaria.image.php in Pixaria Gallery 2.0.0 through 2.3.5 allows remote attackers to read arbitrary files via a base64-encoded file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2923 
Multiple directory traversal vulnerabilities in BitmixSoft PHP-Lance 1.52 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) language parameter to show.php and (2) in parameter to advanced_search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2924 
Multiple SQL injection vulnerabilities in Videos Broadcast Yourself 2 allow remote attackers to execute arbitrary SQL commands via the (1) UploadID parameter to videoint.php, and possibly the (2) cat_id parameter to catvideo.php and (3) uid parameter to cviewchannels.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2925 
Directory traversal vulnerability in DJcalendar.cgi in DJCalendar allows remote attackers to read arbitrary files via a .. (dot dot) in the TEMPLATE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T10:00:00.000Z
CVE-2009-2926 
Multiple SQL injection vulnerabilities in PHP Competition System BETA 0.84 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) day parameter to show_matchs.php and (2) pageno parameter to persons.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2927 
SQL injection vulnerability in DetailFile.php in DigitalSpinners DS CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the nFileId parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2928 
Cross-site scripting (XSS) vulnerability in login.php in TGS Content Management 0.x allows remote attackers to inject arbitrary web script or HTML via the previous_page parameter, a different vector than CVE-2008-6839.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2929 
Multiple SQL injection vulnerabilities in TGS Content Management 0.x allow remote attackers to execute arbitrary SQL commands via the (1) tgs_language_id, (2) tpl_dir, (3) referer, (4) user-agent, (5) site, (6) option, (7) db_optimization, (8) owner, (9) admin_email, (10) default_language, and (11) db_host parameters to cms/index.php; and the (12) cmd, (13) s_dir, (14) minutes, (15) s_mask, (16) test3_mp, (17) test15_file1, (18) submit, (19) brute_method, (20) ftp_server_port, (21) userfile14, (22) subj, (23) mysql_l, (24) action, and (25) userfile1 parameters to cms/frontpage_ception.php. NOTE: some of these parameters may be applicable only in nonstandard versions of the product, and cms/frontpage_ception.php may be cms/frontpage_caption.php in all released versions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2930 
Cross-site scripting (XSS) vulnerability in the Search feature in elka CMS (aka Elkapax) allows remote attackers to inject arbitrary web script or HTML via the q parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2931 
Directory traversal vulnerability in p.php in SlideShowPro Director 1.1 through 1.3.8 allows remote attackers to read arbitrary files via directory traversal sequences in the a parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2932 
Cross-site scripting (XSS) vulnerability in uddiclient/process in the UDDI client in SAP NetWeaver Application Server (Java) 7.0 allows remote attackers to inject arbitrary web script or HTML via the TModel Key field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2933 
SQL injection vulnerability in comments.php in Piwigo before 2.0.3 allows remote attackers to execute arbitrary SQL commands via the items_number parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2934 
Multiple stack-based buffer overflows in xaudio.dll in Programmed Integration PIPL 2.5.0 and 2.5.0D allow remote attackers to execute arbitrary code via a long string in a (1) .pls or (2) .pl playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-21T20:21:00.000Z
CVE-2009-2935 
Google V8, as used in Google Chrome before 2.0.172.43, allows remote attackers to bypass intended restrictions on reading memory, and possibly obtain sensitive information or execute arbitrary code in the Chrome sandbox, via crafted JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T16:31:00.000Z
CVE-2009-2936 
The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives.  NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T16:00:00.000Z
CVE-2009-2937 
Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-2939 
The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix 2.5.5 package grants the postfix user write access to /var/spool/postfix/pid, which might allow local users to conduct symlink attacks that overwrite arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-21T19:00:00.000Z
CVE-2009-2940 
The pygresql module 3.8.1 and 4.0 for Python does not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-22T16:00:00.000Z
CVE-2009-2942 
The mysql-ocaml bindings 1.0.4 for MySQL do not properly support the mysql_real_escape_string function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-22T16:00:00.000Z
CVE-2009-2943 
The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL libpq do not properly support the PQescapeStringConn function, which might allow remote attackers to leverage escaping issues involving multibyte character encodings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-22T16:00:00.000Z
CVE-2009-2944 
Incomplete blacklist vulnerability in the teximg plugin in ikiwiki before 3.1415926 and 2.x before 2.53.4 allows context-dependent attackers to read arbitrary files via crafted TeX commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-31T20:00:00.000Z
CVE-2009-2945 
weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T22:00:00.000Z
CVE-2009-2946 
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T20:00:00.000Z
CVE-2009-2947 
Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 allows remote attackers to inject arbitrary web script or HTML via unspecified CGI parameter values, which are sometimes included in exception messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z