rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-1449 
Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka CoolPlayer+ Portable) 2.19.1 allows remote attackers to execute arbitrary code via a skin file (skin.ini) with a large PlaylistSkin parameter.  NOTE: this may overlap CVE-2008-5735.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-27T22:00:00.000Z
CVE-2009-1450 
PHP remote file inclusion vulnerability in format.php in SMA-DB 0.3.12 allows remote attackers to execute arbitrary PHP code via a URL in the _page_content parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T15:00:00.000Z
CVE-2009-1451 
Cross-site scripting (XSS) vulnerability in startpage.php in SMA-DB 0.3.12 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T15:00:00.000Z
CVE-2009-1452 
Multiple PHP remote file inclusion vulnerabilities in theme/format.php in SMA-DB 0.3.13 allow remote attackers to execute arbitrary PHP code via a URL in the (1) _page_css and (2) _page_javascript parameters. NOTE: the _page_content vector is already is covered by CVE-2009-1450.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1453 
SQL injection vulnerability in class.eport.php in Tiny Blogr 1.0.0 rc4, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the txtUsername parameter (aka the Username field).  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1454 
Cross-site scripting (XSS) vulnerability in tasks.php in WebCollab before 2.50 (aka Billy Goat) allows remote attackers to inject arbitrary web script or HTML via the selection parameter in a todo action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1455 
Multiple cross-site request forgery (CSRF) vulnerabilities in WebCollab before 2.50 (aka Billy Goat) allow remote attackers to hijack the authentication of administrators for requests that change an arbitrary password or have other unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1456 
Directory traversal vulnerability in admin.php in Malleo 1.2.3 allows remote authenticated administrators to include and execute arbitrary local files via a .. (dot dot) in the module parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1457 
Cross-site scripting (XSS) vulnerability in player.php in Nuke Evolution Xtreme 2.x allows remote attackers to inject arbitrary web script or HTML via the defaultVisualExt parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1458 
Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php in razorCMS before 0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the slab parameter in an edit action, (2) the catname parameter in a showcats action, and (3) the cat parameter in a reordercat action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1459 
Cross-site request forgery (CSRF) vulnerability in razorCMS before 0.4 allows remote attackers to hijack the authentication of administrators for requests that create a web page containing PHP code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1460 
razorCMS before 0.4 uses weak permissions for (1) admin/core/admin_config.php, which allows local users to obtain the administrator's password hash and FTP user credentials; and (2) the root directory, (3) datastore/, and (4) admin/core/, which allows local users to have an unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1461 
Cross-site scripting (XSS) vulnerability in the Create New Page form in razorCMS 0.3 RC2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Page Title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1462 
The Security Manager in razorCMS before 0.4 does not verify the permissions of every file owned by the apache user account, which is inconsistent with the documentation and allows local users to have an unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1463 
Static code injection vulnerability in razorCMS before 0.4 allows remote attackers to inject arbitrary PHP code into any page by saving content as a .php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-28T16:00:00.000Z
CVE-2009-1464 
Multiple cross-site request forgery (CSRF) vulnerabilities in index.aas in Application Access Server (A-A-S) 2.0.48 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary programs via a command job, (2) stop services via a setservice job, or (3) terminate processes via a killprocess job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-14T17:00:00.000Z
CVE-2009-1465 
Application Access Server (A-A-S) 2.0.48 has "wildbat" as its default password for the admin account, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-14T17:00:00.000Z
CVE-2009-1466 
Application Access Server (A-A-S) 2.0.48 stores (1) passwords and (2) the port keyword in cleartext in aas.ini, which allows local users to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-14T17:00:00.000Z
CVE-2009-1467 
Multiple cross-site scripting (XSS) vulnerabilities in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the body of a message, related to the email view and incorrect HTML filtering in the cleanHTML function in server/inc/tools.php; or the (2) title, (3) link, or (4) description element in an RSS feed, related to the getHTML function in server/inc/rss/item.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-05T20:00:00.000Z
CVE-2009-1468 
Multiple SQL injection vulnerabilities in the search form in server/webmail.php in the Groupware component in IceWarp eMail Server and WebMail Server before 9.4.2 allow remote authenticated users to execute arbitrary SQL commands via the (1) sql and (2) order_by elements in an XML search query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-05T20:00:00.000Z
CVE-2009-1469 
CRLF injection vulnerability in the Forgot Password implementation in server/webmail.php in IceWarp eMail Server and WebMail Server before 9.4.2 makes it easier for remote attackers to trick a user into disclosing credentials via CRLF sequences preceding a Reply-To header in the subject element of an XML document, as demonstrated by triggering an e-mail message from the server that contains a user's correct credentials, and requests that the user compose a reply that includes this message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-05T20:00:00.000Z
CVE-2009-1472 
The Java client program for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 has a hardcoded AES encryption key, which makes it easier for man-in-the-middle attackers to (1) execute arbitrary Java code, or (2) gain access to machines connected to the switch, by hijacking a session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-27T16:00:00.000Z
CVE-2009-1473 
The (1) Windows and (2) Java client programs for the ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not properly use RSA cryptography for a symmetric session-key negotiation, which makes it easier for remote attackers to (a) decrypt network traffic, or (b) conduct man-in-the-middle attacks, by repeating unspecified "client-side calculations."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-27T16:00:00.000Z
CVE-2009-1474 
The ATEN KH1516i IP KVM switch with firmware 1.0.063 and the KN9116 IP KVM switch with firmware 1.1.104 do not (1) encrypt mouse events, which makes it easier for man-in-the-middle attackers to perform mouse operations on machines connected to the switch by injecting network traffic; and do not (2) set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-27T16:00:00.000Z
CVE-2009-1476 
Buffer overflow in lib/load_http.c in ippool in Darren Reed IPFilter (aka IP Filter) 4.1.31 allows local users to gain privileges via vectors involving a long hostname in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-26T15:16:00.000Z
CVE-2009-1477 
The https web interfaces on the ATEN KH1516i IP KVM switch with firmware 1.0.063, the KN9116 IP KVM switch with firmware 1.1.104, and the PN9108 power-control unit have a hardcoded SSL private key, which makes it easier for remote attackers to decrypt https sessions by extracting this key from their own switch and then sniffing network traffic to a switch owned by a different customer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-27T16:00:00.000Z
CVE-2009-1478 
Multiple unspecified vulnerabilities in the DTrace ioctl handlers in Sun Solaris 10, and OpenSolaris before snv_114, allow local users to cause a denial of service (panic) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T15:00:00.000Z
CVE-2009-1479 
Directory traversal vulnerability in client/desktop/default.htm in Boxalino before 09.05.25-0421 allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-22T15:26:00.000Z
CVE-2009-1480 
SQL injection vulnerability in index.php Pragyan CMS 2.6.4 allows remote attackers to execute arbitrary SQL commands via the fileget parameter in a view action and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1481 
SQL injection vulnerability in action.asp in PuterJam's Blog (PJBlog3) 3.0.6.170 allows remote attackers to execute arbitrary SQL commands via the cname parameter in a checkAlias action, as exploited in the wild in April 2009.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1482 
Multiple cross-site scripting (XSS) vulnerabilities in action/AttachFile.py in MoinMoin 1.8.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) an AttachFile sub-action in the error_msg function or (2) multiple vectors related to package file errors in the upload_form function, different vectors than CVE-2009-0260.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1483 
Unrestricted file upload vulnerability in upload-file.php in Adam Patterson Studio Lounge Address Book 2.5, as reachable from index2.php, allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in profiles/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1484 
Cross-site scripting (XSS) vulnerability in the web mail interface feature in AXIGEN Mail Server 6.2.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving e-mail messages.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1485 
The logging feature in eMule Plus before 1.2e allows remote attackers to cause a denial of service (infinite loop) via unspecified attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1486 
Directory traversal vulnerability in pmscript.php in Flatchat 3.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the with parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1487 
SQL injection vulnerability in pages/login.php in FunGamez RC1 allows remote attackers to execute arbitrary SQL commands via the login_user (aka username) parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1488 
Directory traversal vulnerability in admin/load.php in FunGamez RC1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1489 
includes/user.php in Fungamez RC1 allows remote attackers to bypass authentication and gain administrative access by setting the user cookie parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-29T18:06:00.000Z
CVE-2009-1490 
Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via a long X- header, as demonstrated by an X-Testing header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-05T19:00:00.000Z
CVE-2009-1491 
McAfee GroupShield for Microsoft Exchange on Exchange Server 2000, and possibly other anti-virus or anti-spam products from McAfee or other vendors, does not scan X- headers for malicious content, which allows remote attackers to bypass virus detection via a crafted message, as demonstrated by a message with an X-Testing header and no message body.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-05T19:00:00.000Z
CVE-2009-1492 
The getAnnots Doc method in the JavaScript API in Adobe Reader and Acrobat 9.1, 8.1.4, 7.1.1, and earlier allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that contains an annotation, and has an OpenAction entry with JavaScript code that calls this method with crafted integer arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-30T20:00:00.000Z
CVE-2009-1493 
The customDictionaryOpen spell method in the JavaScript API in Adobe Reader 9.1, 8.1.4, 7.1.1, and earlier on Linux and UNIX allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a PDF file that triggers a call to this method with a long string in the second argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-30T20:00:00.000Z
CVE-2009-1494 
The process_stat function in Memcached 1.2.8 discloses memory-allocation statistics in response to a stats malloc command, which allows remote attackers to obtain potentially sensitive information by sending this command to the daemon's TCP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-30T20:00:00.000Z
CVE-2009-1495 
Web File Explorer 3.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/db.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T16:00:00.000Z
CVE-2009-1496 
Directory traversal vulnerability in the Cmi Marketplace (com_cmimarketplace) component 0.1 for Joomla! allows remote attackers to list arbitrary directories via a .. (dot dot) in the viewit parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T16:00:00.000Z
CVE-2009-1497 
Stack-based buffer overflow in srt2smi.exe in Gretech Online Movie Player (GOM Player) 2.1.16.4635 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long string in an SRT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T16:00:00.000Z
CVE-2009-1498 
Directory traversal vulnerability in inc/profilemain.php in Game Maker 2k Internet Discussion Boards (iDB) 0.2.5 Pre-Alpha SVN 243 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the skin parameter in a settings action to profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T16:00:00.000Z
CVE-2009-1499 
SQL injection vulnerability in the MailTo (aka com_mailto) component in Joomla! allows remote attackers to execute arbitrary SQL commands via the article parameter in index.php.  NOTE: SecurityFocus states that this issue has been disputed by the vendor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T16:00:00.000Z
CVE-2009-1500 
SQL injection vulnerability in index.php in ProjectCMS 1.0 Beta allows remote attackers to execute arbitrary SQL commands via the sn parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1501 
Cross-site scripting (XSS) vulnerability in the Exif module 5.x-1.x before 5.x-1.2 and 6.x-1.x-dev before April 13, 2009, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via EXIF tags in an image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1502 
Directory traversal vulnerability in plugin.php in S-Cms 1.1 Stable and 1.5.2 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1503 
Multiple SQL injection vulnerabilities in login.php in Tiger Document Management System (DMS) allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1504 
Absolute Form Processor XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting the xlaAFPadmin cookie to "lvl=1&userid=1."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1505 
SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1506 
SQL injection vulnerability in classes/Xp.php in eLitius 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter to banner-details.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1507 
The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T17:00:00.000Z
CVE-2009-1508 
SQL injection vulnerability in the xforum_validateUser function in Common.php in X-Forum 0.6.2 allows remote attackers to execute arbitrary SQL commands, as demonstrated via the cookie_username parameter to Configure.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T18:00:00.000Z
CVE-2009-1509 
SQL injection vulnerability in ajaxp_backend.php in MyioSoft AjaxPortal 3.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T18:00:00.000Z
CVE-2009-1510 
Multiple directory traversal vulnerabilities in KoschtIT Image Gallery 1.82 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the file parameter to (1) ki_makepic.php and (2) ki_nojsdisplayimage.php in ki_base/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T18:00:00.000Z
CVE-2009-1511 
GDI+ in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (infinite loop) via a PNG file that contains a certain large btChunkLen value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T18:00:00.000Z
CVE-2009-1512 
Static code injection vulnerability in X-Forum 0.6.2 allows remote authenticated administrators to inject arbitrary PHP code into Config.php via the adminEMail parameter to SaveConfig.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-01T22:00:00.000Z
CVE-2009-1513 
Buffer overflow in the PATinst function in src/load_pat.cpp in libmodplug before 0.8.7 allows user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via a long instrument name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-04T16:12:00.000Z
CVE-2009-1514 
Google Chrome 1.0.154.53 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a throw statement with a long exception value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-04T16:12:00.000Z
CVE-2009-1515 
Heap-based buffer overflow in the cdf_read_sat function in src/cdf.c in Christos Zoulas file 5.00 allows user-assisted remote attackers to execute arbitrary code via a crafted compound document file, as demonstrated by a .msi, .doc, or .mpp file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-04T16:12:00.000Z