rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-1699 
The XSL stylesheet implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle XML external entities, which allows remote attackers to read arbitrary files via a crafted DTD, as demonstrated by a file:///etc/passwd URL in an entity declaration, related to an "XXE attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1700 
The XSLT implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read XML content from arbitrary web pages via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1701 
Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1702 
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to improper handling of Location and History objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1703 
WebKit in Apple Safari before 4.0 does not prevent references to file: URLs within (1) audio and (2) video elements, which allows remote attackers to determine the existence of arbitrary files via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1704 
CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1705 
CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1706 
The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users via a cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1707 
Race condition in the Reset Safari implementation in Apple Safari before 4.0 on Windows might allow local users to read stored web-site passwords via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1708 
Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites, which allows remote attackers to open arbitrary local help files, and execute arbitrary code or obtain sensitive information, via a crafted call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1709 
Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1710 
WebKit in Apple Safari before 4.0 allows remote attackers to spoof the browser's display of (1) the host name, (2) security indicators, and unspecified other UI elements via a custom cursor in conjunction with a modified CSS3 hotspot property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1711 
WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1712 
WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets, which allows remote attackers to execute arbitrary code, gain privileges, or obtain sensitive information via an APPLET or OBJECT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1713 
The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1714 
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1715 
Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1716 
CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1717 
Integer overflow in Terminal in Apple Mac OS X 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted size value in a CSI[4 xterm resize escape sequence that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-05T15:25:00.000Z
CVE-2009-1718 
WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to obtain sensitive information via vectors involving drag events and the dragging of content over a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-10T17:37:00.000Z
CVE-2009-1719 
The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-16T23:00:00.000Z
CVE-2009-1720 
Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-31T18:29:00.000Z
CVE-2009-1721 
The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-31T18:29:00.000Z
CVE-2009-1722 
Heap-based buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-31T18:29:00.000Z
CVE-2009-1723 
CFNetwork in Apple Mac OS X 10.5 before 10.5.8 places an incorrect URL in a certificate warning in certain 302 redirection scenarios, which makes it easier for remote attackers to trick a user into visiting an arbitrary https web site by leveraging an open redirect vulnerability, a different issue than CVE-2009-2062.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T15:00:00.000Z
CVE-2009-1724 
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to inject arbitrary web script or HTML via vectors related to parent and top objects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T17:00:00.000Z
CVE-2009-1725 
WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-09T17:00:00.000Z
CVE-2009-1726 
Heap-based buffer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5 before 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted image containing an embedded ColorSync profile.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T16:00:00.000Z
CVE-2009-1727 
Incomplete blacklist vulnerability in CoreTypes in Apple Mac OS X 10.5 before 10.5.8 makes it easier for user-assisted remote attackers to execute arbitrary JavaScript via a web page that offers a download with a Content-Type value that is not on the list of possibly unsafe content types for Safari.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T16:00:00.000Z
CVE-2009-1728 
Stack-based buffer overflow in Image RAW in Apple Mac OS X 10.5 before 10.5.8, and 10.4 before Digital Camera RAW Compatibility Update 2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-06T16:00:00.000Z
CVE-2009-1729 
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Communications Express 6 2005Q4 (aka 6.2) and 6.3 allow remote attackers to inject arbitrary web script or HTML via (1) the abperson_displayName parameter to uwc/abs/search.xml in the Add Contact implementation in the Personal Address Book component or (2) the temporaryCalendars parameter to uwc/base/UWCMain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T14:00:00.000Z
CVE-2009-1730 
Multiple directory traversal vulnerabilities in NetMechanica NetDecision TFTP Server 4.2 allow remote attackers to read or modify arbitrary files via directory traversal sequences in the (1) GET or (2) PUT command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T18:00:00.000Z
CVE-2009-1731 
SQL injection vulnerability in panel/index.php in MLFFAT 2.1 allows remote attackers to execute arbitrary SQL commands via a base64-encoded supervisor cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T18:00:00.000Z
CVE-2009-1732 
Cross-site scripting (XSS) vulnerability in admin/usermanager in IPplan 4.91a allows remote attackers to inject arbitrary web script or HTML via the grp parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1733 
Cross-site request forgery (CSRF) vulnerability in IPplan 4.91a allows remote attackers to hijack the authentication of administrators for requests that (1) change the password, (2) add users, or (3) delete users via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1734 
SQL injection vulnerability in listing_video.php in VidSharePro allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1735 
Cross-site scripting (XSS) vulnerability in search.php in VidSharePro allows remote attackers to inject arbitrary web script or HTML via the searchtxt parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1736 
SQL injection vulnerability in the GridSupport (GS) Ticket System (com_gsticketsystem) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a viewCategory action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1737 
Directory traversal vulnerability in bom.php in MyPic 2.1 allows remote attackers to list files in arbitrary directories via a .. (dot dot) in the dir parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1738 
Cross-site scripting (XSS) vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1739 
PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including administrative privileges, by setting the authuser cookie parameter to a valid username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1740 
Multiple heap-based buffer overflows in the D-Link MPEG4 Viewer ActiveX Control (csviewer.ocx) 2.11.918.2006 allow remote attackers to execute arbitrary code via a long argument to the (1) SetFilePath and (2) SetClientCookie methods.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1741 
Multiple SQL injection vulnerabilities in login.php in DM FileManager 3.9.2, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) Password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1742 
code.php in PC4Arb Pc4 Uploader 9.0 and earlier makes it easier for remote attackers to conduct SQL injection attacks via crafted keyword sequences that are removed from a filter in the id parameter in a banner action, as demonstrated via the "UNIunionON" string, which is collapsed into "UNION" by the filter_sql function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-20T19:00:00.000Z
CVE-2009-1743 
Directory traversal vulnerability in InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to create and overwrite arbitrary files via a filename containing a ..\ (dot dot backslash) sequence in a Hollywood FX Compressed Archive (.hfz) file.  NOTE: this can be leveraged for code execution by decompressing a file to a Startup folder.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T00:00:00.000Z
CVE-2009-1744 
InstallHFZ.exe 6.5.201.0 in Pinnacle Hollywood Effects 6, a module in Pinnacle Systems Pinnacle Studio 12, allows remote attackers to cause a denial of service (application crash) via a crafted Hollywood FX Compressed Archive (.hfz) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T01:00:00.000Z
CVE-2009-1745 
Armorlogic Profense Web Application Firewall before 2.2.22, and 2.4.x before 2.4.4, has a default root password hash, and permits password-based root logins over SSH, which makes it easier for remote attackers to obtain access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T15:00:00.000Z
CVE-2009-1746 
SQL injection vulnerability in berita.php in Dian Gemilang DGNews 3.0 Beta allows remote attackers to execute arbitrary SQL commands via the id parameter in a detail action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T15:00:00.000Z
CVE-2009-1747 
SQL injection vulnerability in index.php in 26th Avenue bSpeak 1.10 allows remote attackers to execute arbitrary SQL commands via the forumid parameter in a post action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2009-1748 
Multiple directory traversal vulnerabilities in index.php in Catviz 0.4.0 Beta 1 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) webpages_form or (2) userman_form parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2009-1749 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Catviz 0.4.0 beta 1 allow remote attackers to inject arbitrary web script or HTML via the (1) userman_form and (2) webpages_form parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2009-1750 
Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2009-1751 
SQL injection vulnerability in list_list.php in Realty Webware Technologies Web-Base 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2009-1752 
exJune Office Message System 1 does not properly restrict access to (1) configure.asp and (2) addmessage2.asp, which allows remote attackers to gain privileges a direct request.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T18:00:00.000Z
CVE-2009-1753 
Coccinelle 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on an unspecified "result file."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-21T23:00:00.000Z
CVE-2009-1754 
The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted attackers to access application data by creating a package that specifies a shared user ID with an arbitrary application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-26T15:16:00.000Z
CVE-2009-1755 
Off-by-one error in the packet_read_query_section function in packet.c in nsd 3.2.1, and process_query_section in query.c in nsd 2.3.7, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-22T01:00:00.000Z
CVE-2009-1756 
SLiM Simple Login Manager 1.3.0 places the X authority magic cookie (mcookie) on the command line when invoking xauth from (1) app.cpp and (2) switchuser.cpp, which allows local users to access the X session by listing the process and its arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-22T01:00:00.000Z
CVE-2009-1757 
Cross-site request forgery (CSRF) vulnerability in Transmission 1.5 before 1.53 and 1.6 before 1.61 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-22T01:00:00.000Z
CVE-2009-1758 
The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in "certain address ranges."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-22T01:00:00.000Z
CVE-2009-1759 
Stack-based buffer overflow in the btFiles::BuildFromMI function (trunk/btfiles.cpp) in Enhanced CTorrent (aka dTorrent) 3.3.2 and probably earlier, and CTorrent 1.3.4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Torrent file containing a long path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-05-22T01:00:00.000Z
CVE-2009-1760 
Directory traversal vulnerability in src/torrent_info.cpp in Rasterbar libtorrent before 0.14.4, as used in firetorrent, qBittorrent, deluge Torrent, and other applications, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) and partial relative pathname in a Multiple File Mode list element in a .torrent file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-11T21:00:00.000Z
CVE-2009-1761 
The message engine in CA ARCserve Backup r12.0 and r12.0 SP1 for Windows allows remote attackers to cause a denial of service (crash) via (1) an invalid 0x13 message, which is not properly handled in the ASCORE module, or (2) a 0x3B message with invalid stub data that triggers an RPC marshalling error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-06-16T23:00:00.000Z