rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-0562 
The Office Web Components ActiveX Control in Microsoft Office XP SP3, Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 SP1, and Office Small Business Accounting 2006 does not properly allocate memory, which allows remote attackers to execute arbitrary code via unspecified vectors that trigger "system state" corruption, aka "Office Web Components Memory Allocation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T17:00:00.000Z
CVE-2009-0563 
Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; Microsoft Office Word Viewer 2003 SP3; Microsoft Office Word Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a crafted tag containing an invalid length field, aka "Word Buffer Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-0565 
Buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open XML File Format Converter for Mac; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a Word document with a malformed record that triggers memory corruption, aka "Word Buffer Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-0566 
Microsoft Office Publisher 2007 SP1 does not properly calculate object handler data for Publisher files, which allows remote attackers to execute arbitrary code via a crafted file in a legacy format that triggers memory corruption, aka "Pointer Dereference Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-15T15:00:00.000Z
CVE-2009-0568 
The RPC Marshalling Engine (aka NDR) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 SP2 does not properly maintain its internal state, which allows remote attackers to overwrite arbitrary memory locations via a crafted RPC message that triggers incorrect pointer reading, related to "IDL interfaces containing a non-conformant varying array" and FC_SMVARRAY, FC_LGVARRAY, FC_VARIABLE_REPEAT, and FC_VARIABLE_OFFSET, aka "RPC Marshalling Engine Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-0569 
Buffer overflow in Becky! Internet Mail 2.48.02 and earlier allows remote attackers to execute arbitrary code via a mail message with a crafted return receipt request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T01:00:00.000Z
CVE-2009-0570 
Directory traversal vulnerability in send.php in Ninja Designs Mailist 3.0, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the load parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T17:00:00.000Z
CVE-2009-0571 
admin.php in Ninja Designs Mailist 3.0 stores backup copies of maillist.php under the web root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the backup directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T17:00:00.000Z
CVE-2009-0572 
PHP remote file inclusion vulnerability in include/flatnux.php in FlatnuX CMS (aka Flatnuke3) 2009-01-27 and 2009-02-04, when register_globals is enabled and magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the _FNROOTPATH parameter to (1) index.php and (2) filemanager.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T17:00:00.000Z
CVE-2009-0573 
Multiple cross-site scripting (XSS) vulnerabilities in FotoWeb 6.0 (Build 273) allow remote attackers to inject arbitrary web script or HTML via the (1) s parameter to cmdrequest/Login.fwx and the (2) search parameter to Grid.fwx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T17:00:00.000Z
CVE-2009-0574 
SQL injection vulnerability in index.php in Easy CafeEngine allows remote attackers to execute arbitrary SQL commands via the catid parameter, a different vector than CVE-2008-4604.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T17:00:00.000Z
CVE-2009-0575 
Cross-site scripting (XSS) vulnerability in the theme_views_bulk_operations_confirmation function in views_bulk_operations.module in Views Bulk Operations 5.x before 5.x-1.3 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T17:00:00.000Z
CVE-2009-0576 
Unspecified vulnerability in Sun Java System Directory Server 5.2 p6 and earlier, and Enterprise Edition 5, allows remote attackers to cause a denial of service (daemon crash) via crafted LDAP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-13T17:00:00.000Z
CVE-2009-0577 
Integer overflow in the WriteProlog function in texttops in CUPS 1.1.17 on Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to execute arbitrary code via a crafted PostScript file that triggers a heap-based buffer overflow.  NOTE: this issue exists because of an incorrect fix for CVE-2008-3640.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-20T19:00:00.000Z
CVE-2009-0578 
GNOME NetworkManager before 0.7.0.99 does not properly verify privileges for dbus (1) modify and (2) delete requests, which allows local users to change or remove the network connections of arbitrary users via unspecified vectors related to org.freedesktop.NetworkManagerUserSettings and at_console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0579 
Linux-PAM before 1.0.4 does not enforce the minimum password age (MINDAYS) as specified in /etc/shadow, which allows local users to bypass intended security policy and change their passwords sooner than specified.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-04-16T15:00:00.000Z
CVE-2009-0580 
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-05T15:25:00.000Z
CVE-2009-0581 
Memory leak in LittleCMS (aka lcms or liblcms) before 1.18beta2, as used in Firefox 3.1beta, OpenJDK, and GIMP, allows context-dependent attackers to cause a denial of service (memory consumption and application crash) via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T14:00:00.000Z
CVE-2009-0582 
The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-14T18:00:00.000Z
CVE-2009-0583 
Multiple integer overflows in icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allow context-dependent attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly execute arbitrary code by using a device file for a translation request that operates on a crafted image file and targets a certain "native color space," related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T19:26:00.000Z
CVE-2009-0584 
icc.c in the International Color Consortium (ICC) Format library (aka icclib), as used in Ghostscript 8.64 and earlier and Argyll Color Management System (CMS) 1.0.3 and earlier, allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using a device file for processing a crafted image file associated with large integer values for certain sizes, related to an ICC profile in a (1) PostScript or (2) PDF file with embedded images.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-23T19:26:00.000Z
CVE-2009-0585 
Integer overflow in the soup_base64_encode function in soup-misc.c in libsoup 2.x.x before 2.2.x, and 2.x before 2.24, allows context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-14T18:00:00.000Z
CVE-2009-0586 
Integer overflow in the gst_vorbis_tag_add_coverart function (gst-libs/gst/tag/gstvorbistag.c) in vorbistag in gst-plugins-base (aka gstreamer-plugins-base) before 0.10.23 in GStreamer allows context-dependent attackers to execute arbitrary code via a crafted COVERART tag that is converted from a base64 representation, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-14T18:00:00.000Z
CVE-2009-0587 
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent attackers to execute arbitrary code via a long string that is converted to a base64 representation in (1) addressbook/libebook/e-vcard.c in evc or (2) camel/camel-mime-utils.c in libcamel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-14T18:00:00.000Z
CVE-2009-0588 
agent/request/op.cgi in the Registration Authority (RA) component in Red Hat Certificate System (RHCS) 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-27T16:00:00.000Z
CVE-2009-0590 
The ASN1_STRING_print_ex function in OpenSSL before 0.9.8k allows remote attackers to cause a denial of service (invalid memory access and application crash) via vectors that trigger printing of a (1) BMPString or (2) UniversalString with an invalid encoded length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-27T16:00:00.000Z
CVE-2009-0591 
The CMS_verify function in OpenSSL 0.9.8h through 0.9.8j, when CMS is enabled, does not properly handle errors associated with malformed signed attributes, which allows remote attackers to repudiate a signature that originally appeared to be valid but was actually invalid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-27T16:00:00.000Z
CVE-2009-0592 
Multiple directory traversal vulnerabilities in PNphpBB2 1.2i and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the ModName parameter to (1) admin_words.php, (2) admin_groups_reapir.php, (3) admin_smilies.php, (4) admin_ranks.php, (5) admin_styles.php, and (6) admin_users.php in admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2009-0593 
SQL injection vulnerability in members.php in plx Auto Reminder 3.7 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a newar action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2009-0594 
Cross-site scripting (XSS) vulnerability in index.php in phpSkelSite 1.4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2009-0595 
PHP remote file inclusion vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2009-0596 
Directory traversal vulnerability in skysilver/login.tpl.php in phpSkelSite 1.4, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the TplSuffix parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2009-0597 
SQL injection vulnerability in admin/index.php in w3b>cms (aka w3blabor CMS) before 3.4.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the benutzername parameter (aka Username field) in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2009-0598 
SQL injection vulnerability in index.php in PhpMesFilms 1.0 and 1.8 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T17:00:00.000Z
CVE-2009-0599 
Buffer overflow in wiretap/netscreen.c in Wireshark 0.99.7 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a malformed NetScreen snoop file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T20:00:00.000Z
CVE-2009-0600 
Wireshark 0.99.6 through 1.0.5 allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted Tektronix K12 text capture file, as demonstrated by a file with exactly one frame.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T20:00:00.000Z
CVE-2009-0601 
Format string vulnerability in Wireshark 0.99.8 through 1.0.5 on non-Windows platforms allows local users to cause a denial of service (application crash) via format string specifiers in the HOME environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T20:00:00.000Z
CVE-2009-0602 
Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in img/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T20:00:00.000Z
CVE-2009-0603 
Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via the description parameter (aka the Help field).  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T20:00:00.000Z
CVE-2009-0604 
SQL injection vulnerability in index.php in PHP Director 0.21 and earlier allows remote attackers to execute arbitrary SQL commands via the searching parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-16T20:00:00.000Z
CVE-2009-0605 
Stack consumption vulnerability in the do_page_fault function in arch/x86/mm/fault.c in the Linux kernel before 2.6.28.5 allows local users to cause a denial of service (memory corruption) or possibly gain privileges via unspecified vectors that trigger page faults on a machine that has a registered Kprobes probe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0606 
The link_image function in linker/linker.c in the dynamic linker in Bionic in Open Handset Alliance Android 1.0 on the T-Mobile G1 phone does not properly handle file descriptors 0, 1, and 2 for a setgid program, which allows local users to create arbitrary files owned by certain groups, possibly a related issue to CVE-2002-0820.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0607 
Multiple integer overflows in malloc_leak.c in Bionic in Open Handset Alliance Android 1.0 have unknown impact and attack vectors, related to the (1) chk_calloc and (2) leak_calloc functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0608 
Integer overflow in the showLog function in fake_log_device.c in liblog in Open Handset Alliance Android 1.0 allows attackers to trigger a buffer overflow and possibly have unspecified other impact by sending a large number of input lines.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0609 
Sun Java System Directory Proxy Server in Sun Java System Directory Server Enterprise Edition 6.0 through 6.3, when a JDBC data source is used, does not properly handle (1) a long value in an ADD or (2) long string attributes, which allows remote attackers to cause a denial of service (JDBC backend outage) via crafted LDAP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0610 
Multiple static code injection vulnerabilities in post.php in Simple PHP News 1.0 final allow remote attackers to inject arbitrary PHP code into news.txt via the (1) title or (2) date parameter, and then execute the code via a direct request to display.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0611 
Multiple cross-site scripting (XSS) vulnerabilities in qfsearch/AdminServlet in QuickFinder Server in Novell Open Enterprise Server 1.x allow remote attackers to inject arbitrary web script or HTML via (1) the siteloc parameter in a displayaddsite action, the site parameter in a (2) generalproperties or (3) clusterserviceproperties action, (4) the adminurl parameter in a global action, or (5) the print-list parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0612 
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0613 
Trend Micro InterScan Web Security Suite (IWSS) 3.1 before build 1237 allows remote authenticated Auditor and Report Only users to bypass intended permission settings, and modify the system configuration, via requests to unspecified JSP pages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-17T17:00:00.000Z
CVE-2009-0614 
Unspecified vulnerability in the Web Server in Cisco Unified MeetingPlace Web Conferencing 6.0 before 6.0(517.0) (aka 6.0 MR4) and 7.0 before 7.0(2) (aka 7.0 MR1) allows remote attackers to bypass authentication and obtain administrative access via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z
CVE-2009-0615 
Directory traversal vulnerability in Cisco Application Networking Manager (ANM) before 2.0 and Application Control Engine (ACE) Device Manager before A3(2.1) allows remote authenticated users to read or modify arbitrary files via unspecified vectors, related to "invalid directory permissions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z
CVE-2009-0616 
Cisco Application Networking Manager (ANM) before 2.0 uses default usernames and passwords, which makes it easier for remote attackers to access the application, or cause a denial of service via configuration changes, related to "default user credentials during installation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z
CVE-2009-0617 
Cisco Application Networking Manager (ANM) before 2.0 uses a default MySQL root password, which makes it easier for remote attackers to execute arbitrary operating-system commands or change system files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z
CVE-2009-0618 
Unspecified vulnerability in the Java agent in Cisco Application Networking Manager (ANM) before 2.0 Update A allows remote attackers to gain privileges, and cause a denial of service (service outage) by stopping processes, or obtain sensitive information by reading configuration files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z
CVE-2009-0619 
Unspecified vulnerability in the Session Border Controller (SBC) before 3.0(2) for Cisco 7600 series routers allows remote attackers to cause a denial of service (SBC card reload) via crafted packets to TCP port 2000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-03-05T02:00:00.000Z
CVE-2009-0620 
Cisco ACE Application Control Engine Module for Catalyst 6500 Switches and 7600 Routers before A2(1.1) uses default (1) usernames and (2) passwords for (a) the administrator and (b) web management, which makes it easier for remote attackers to perform configuration changes or obtain operating-system access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z
CVE-2009-0621 
Cisco ACE 4710 Application Control Engine Appliance before A1(8a) uses default (1) usernames and (2) passwords for (a) the administrator, (b) web management, and (c) device management, which makes it easier for remote attackers to perform configuration changes to the Device Manager and other components, or obtain operating-system access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-02-26T16:00:00.000Z