rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-4758 
Stack-based buffer overflow in dicas Mpegable Player 2.12 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .YUV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-29T18:00:00.000Z
CVE-2009-4759 
Buffer overflow in BrotherSoft BMXPlay 0.4.4b allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .BMX file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-29T18:00:00.000Z
CVE-2009-4760 
Winn ASP Guestbook 1.01 Beta stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data/guestbook.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-29T18:00:00.000Z
CVE-2009-4761 
Stack-based buffer overflow in Mini-stream RM Downloader allows remote attackers to execute arbitrary code via a long string in a .smi file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-29T18:00:00.000Z
CVE-2009-4762 
MoinMoin 1.7.x before 1.7.3 and 1.8.x before 1.8.3 checks parent ACLs in certain inappropriate circumstances during processing of hierarchical ACLs, which allows remote attackers to bypass intended access restrictions by requesting an item, a different vulnerability than CVE-2008-6603.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-29T20:00:00.000Z
CVE-2009-4763 
Unspecified vulnerability in the ClickHeat plugin, as used in phpMyVisites before 2.4, has unknown impact and attack vectors.  NOTE: due to lack of details from the vendor, it is not clear whether this is related to CVE-2008-5793.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-30T23:00:00.000Z
CVE-2009-4764 
Adobe Reader 8.x and 9.x on Windows is able to execute EXE files that are embedded in a PDF document, which makes it easier for remote attackers to trick users into executing arbitrary code via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T15:15:00.000Z
CVE-2009-4765 
CNR Hikaye Portal 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/hikaye.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-13T18:00:00.000Z
CVE-2009-4766 
YP Portal MS-Pro Surumu (aka MS-Pro Portal Scripti) 1.0 and 1.2 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for galeri/database/db.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-13T18:00:00.000Z
CVE-2009-4767 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Plohni Shoutbox 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) input_name and (2) input_text parameters. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T14:00:00.000Z
CVE-2009-4768 
Unspecified vulnerability in the JASS script interpreter in Warcraft III: The Frozen Throne 1.24b and earlier allows user-assisted remote attackers to execute arbitrary code via a crafted custom map.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T14:00:00.000Z
CVE-2009-4769 
Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T14:00:00.000Z
CVE-2009-4770 
The FTP server component in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 has a default password of pass123 for the moderator account, which makes it easier for remote attackers to obtain privileged access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T14:00:00.000Z
CVE-2009-4771 
The PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal does not properly validate orders, which allows remote attackers to trigger unspecified "duplicate actions" via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T14:00:00.000Z
CVE-2009-4772 
Unspecified vulnerability in the PayPal Website Payments Standard functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal, when a custom checkout completion message is enabled, allows attackers to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T14:00:00.000Z
CVE-2009-4773 
Cross-site request forgery (CSRF) vulnerability in the order-management functionality in the Ubercart module 5.x before 5.x-1.9 and 6.x before 6.x-2.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T14:00:00.000Z
CVE-2009-4774 
Unspecified vulnerability in Sun Solaris 10 and OpenSolaris snv_49 through snv_117, when 64bit mode is used on the Intel x86 platform and a Linux (lx) branded zone is configured, allows local users to cause a denial of service (panic) via unspecified vectors, a different vulnerability than CVE-2007-6225.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4775 
Format string vulnerability in Ipswitch WS_FTP Professional 12 before 12.2 allows remote attackers to cause a denial of service (crash) via format string specifiers in the status code portion of an HTTP response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4776 
Buffer overflow in Hitachi Cosminexus V4 through V8, Processing Kit for XML, and Developer's Kit for Java, as used in products such as uCosminexus, Electronic Form Workflow, Groupmax, and IBM XL C/C++ Enterprise Edition 7 and 8, allows remote attackers to have an unknown impact via vectors related to the use of GIF image processing APIs by a Java application, and a different issue from CVE-2007-3794.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4777 
Unspecified vulnerability in multiple versions of Hitachi JP1/Automatic Job Management System 2 - View, JP1/Integrated Management - View, and JP1/Cm2/SNMP System Observer, allows remote attackers to cause a denial of service ("abnormal" termination) via vectors related to the display of an "invalid GIF file."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4778 
Multiple unspecified vulnerabilities in the PDF distiller in the Attachment Service component in Research In Motion (RIM) BlackBerry Enterprise Server (BES) software 4.1.3 through 4.1.7 and 5.0.0, and BlackBerry Professional Software 4.1.4, allow user-assisted remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .pdf file attachment, a different vulnerability than CVE-2008-3246, CVE-2009-0176, CVE-2009-0219, CVE-2009-2643, and CVE-2009-2646.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4779 
Multiple PHP remote file inclusion vulnerabilities in NukeHall 0.3 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter to (1) blocks.php, (2) messages.php, and (3) stories.php in admin/modules/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4780 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in phpMyFAQ before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) the lang parameter in a sitemap action, (2) the search parameter in a search action, (3) the tagging_id parameter in a search action, (4) the highlight parameter in an artikel action, (5) the artlang parameter in an artikel action, (6) the letter parameter in a sitemap action, (7) the lang parameter in a show action, (8) the cat parameter in a show action, (9) the newslang parameter in a news action, (10) the artlang parameter in a send2friend action, (11) the cat parameter in a send2friend action, (12) the id parameter in a send2friend action, (13) the srclang parameter in a translate action, (14) the id parameter in a translate action, (15) the cat parameter in a translate action, (16) the cat parameter in an add action, or (17) the question parameter in an add action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4781 
TUKEVA Password Reminder before 1.0.0.4 uses a hard-coded password for rem.accdb, which allows local users to discover credentials via a DBI connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4782 
Multiple cross-site scripting (XSS) vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to inject arbitrary web script or HTML via the (1) start, (2) forum, and (3) cat parameters to community/thread.php; (4) start and (5) cat parameters to community/forum.php; and (6) start parameter to blog/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4783 
Multiple SQL injection vulnerabilities in Theeta CMS, possibly 0.01, allow remote attackers to execute arbitrary SQL commands via the start parameter to (1) forum.php and (2) thread.php in community/, and (3) blog/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4784 
SQL injection vulnerability in the Joaktree (com_joaktree) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the treeId parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4785 
SQL injection vulnerability in the Quick News (com_quicknews) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a view_item action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4786 
Multiple cross-site scripting (XSS) vulnerabilities in Pligg before 1.0.3 allow remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to (1) admin/admin_config.php, (2) admin/admin_modules.php, (3) delete.php, (4) editlink.php, (5) submit.php, (6) submit_groups.php, (7) user_add_remove_links.php, and (8) user_settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4787 
Multiple cross-site request forgery (CSRF) vulnerabilities in Pligg before 1.0.3 allow remote attackers to hijack the authentication of administrators for requests that create user accounts or have unspecified other impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4788 
Multiple open redirect vulnerabilities in Pligg 1.0.2 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the (1) return parameter to pligg/login.php and the (2) HTTP Referer header to user_settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4789 
Multiple PHP remote file inclusion vulnerabilities in the MojoBlog component RC 0.15 for Joomla! allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter to (1) wp-comments-post.php and (2) wp-trackback.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-21T14:00:00.000Z
CVE-2009-4790 
Multiple directory traversal vulnerabilities in Sysax Multi Server 4.5 allow remote authenticated users to read or modify arbitrary files via crafted FTP commands.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4791 
Multiple SQL injection vulnerabilities in Family Connections (aka FCMS) before 1.8.2 allow remote attackers to execute arbitrary SQL commands via the (1) letter parameter to addressbook.php, (2) id parameter to recipes.php, (3) year parameter to register.php, (4) poll_id parameter to home.php, and (5) email parameter to lostpw.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4792 
SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4793 
Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then accessing the file via a direct request with an images/gallery/ directory name.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4794 
Multiple SQL injection vulnerabilities in Community CMS 0.5 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to view.php and the (2) a parameter in an event action to calendar.php, reachable through index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4795 
Multiple SQL injection vulnerabilities in Xlight FTP Server before 3.2.1, when ODBC authentication is enabled, allow remote attackers to execute arbitrary SQL commands via the (1) USER (aka username) or (2) PASS (aka password) command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4796 
Multiple SQL injection vulnerabilities in the ExecuteQueries function in private/system/classes/listfactory.class.php in glFusion 1.1.2 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) order and (2) direction parameters to search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4797 
SQL injection vulnerability in browse.php in JobHut 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the pk parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4798 
Multiple SQL injection vulnerabilities in Diskos CMS 6.x allow remote attackers to execute arbitrary SQL commands via the (1) kat parameter to side.asp, and the (2) brugerid and (3) password fields to the administration login feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4799 
Diskos CMS 6.x stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) artikler_prod.mdb or (2) medlemmer.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4800 
Directory traversal vulnerability in Sysax Multi Server 4.3 and 4.5 allows remote authenticated users to delete arbitrary files via a ..// (dot dot slash slash) in a DELE command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-22T14:00:00.000Z
CVE-2009-4801 
EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4802 
SQL injection vulnerability in the Flat Manager (flatmgr) extension before 1.9.16 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4803 
SQL injection vulnerability in the Accessibility Glossary (a21glossary) extension 0.4.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4804 
Cross-site scripting (XSS) vulnerability in the Calendar Base (cal) extension before 1.1.1 for TYPO3, when Internet Explorer 6 is used, allows remote attackers to inject arbitrary web script or HTML via "search parameters."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4805 
Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the storyid parameter to public/view.php or (2) the kill parameter to admin/remove.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4806 
admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4807 
Multiple SQL injection vulnerabilities in Graugon PHP Article Publisher 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) c parameter to index.php and the (2) id parameter to view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4808 
admin.php in Graugon PHP Article Publisher 1.0 allows remote attackers to bypass authentication and obtain administrative access by setting the g_admin cookie to 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4809 
Directory traversal vulnerability in thumbnail.ghp in Easy File Sharing (EFS) Web Server 4.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the vfolder parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4810 
The Secure Remote Password (SRP) implementation in Samhain before 2.5.4 does not check for a certain zero value where required by the protocol, which allows remote attackers to bypass authentication via crafted input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-23T14:00:00.000Z
CVE-2009-4811 
VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\x90 sequence in the USER and PASS commands, a related issue to CVE-2009-3707.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4812 
Wolfram Research webMathematica allows remote attackers to obtain sensitive information via a direct request to the MSP script, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4813 
Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4814 
Cross-site scripting (XSS) vulnerability in Wolfram Research webMathematica allows remote attackers to inject arbitrary web script or HTML via the URI to the MSP script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4815 
Directory traversal vulnerability in Serv-U before 9.2.0.1 allows remote authenticated users to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4816 
Directory traversal vulnerability in api/download_checker.php in MegaLab The Uploader 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4817 
Unrestricted file upload vulnerability in Element-IT Ultimate Uploader 1.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in upload/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4818 
Unrestricted file upload vulnerability in upload.php in PHPSimplicity Simplicity oF Upload 1.3.2 allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, as demonstrated by .php.gif.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4819 
Multiple unrestricted file upload vulnerabilities in upload.php in PHPhotoalbum allow remote attackers to execute arbitrary code by uploading a file with a (1) .php.pgif or (2) .php.pjpeg double extension, then accessing it via a direct request to the file in albums/userpics/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4820 
Angelo-Emlak 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for veribaze/angelo.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z