rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-2681 
Unspecified vulnerability in HP ProCurve Identity Driven Manager (IDM) A.02.x through A.02.03 and A.03.x through A.03.00, on Windows Server 2003 with IAS and Windows Server 2008 with NPS, allows local users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T17:00:00.000Z
CVE-2009-2682 
Unspecified vulnerability in Role-Based Access Control (RBAC) in HP HP-UX B.11.23 and B.11.31 allows local users to bypass intended access restrictions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-24T18:00:00.000Z
CVE-2009-2683 
Unspecified vulnerability in the Sender module in HP Remote Graphics Software (RGS) 5.1.3 through 5.2.6 allows remote authenticated users to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-29T17:00:00.000Z
CVE-2009-2684 
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-2685 
Stack-based buffer overflow in the login form in the management web server in HP Power Manager allows remote attackers to execute arbitrary code via the Login variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-06T15:00:00.000Z
CVE-2009-2686 
Unspecified vulnerability in HP NonStop G06.12.00 through G06.32.00, H06.08.00 through H06.18.01, and J06.04.00 through J06.07.01 allows local users to gain privileges, cause a denial of service, or obtain "access to data" via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-02T16:00:00.000Z
CVE-2009-2687 
The exif_read_data function in the Exif module in PHP before 5.2.10 allows remote attackers to cause a denial of service (crash) via a malformed JPEG image with invalid offset fields, a different issue than CVE-2005-3353.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-05T19:00:00.000Z
CVE-2009-2688 
Multiple integer overflows in glyphs-eimage.c in XEmacs 21.4.22, when running on Windows, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via (1) the tiff_instantiate function processing a crafted TIFF file, (2) the png_instantiate function processing a crafted PNG file, and (3) the jpeg_instantiate function processing a crafted JPEG file, all which trigger a heap-based buffer overflow.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-05T19:00:00.000Z
CVE-2009-2689 
JDK13Services.getProviders in Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, grants full privileges to instances of unspecified object types, which allows context-dependent attackers to bypass intended access restrictions via an untrusted (1) applet or (2) application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T18:00:00.000Z
CVE-2009-2690 
The encoder in Sun Java SE 6 before Update 15, and OpenJDK, grants read access to private variables with unspecified names, which allows context-dependent attackers to obtain sensitive information via an untrusted (1) applet or (2) application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T18:00:00.000Z
CVE-2009-2691 
The mm_for_maps function in fs/proc/base.c in the Linux kernel 2.6.30.4 and earlier allows local users to read (1) maps and (2) smaps files under proc/ via vectors related to ELF loading, a setuid process, and a race condition.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2692 
The Linux kernel 2.6.0 through 2.6.30.4, and 2.4.4 through 2.4.37.4, does not initialize all function pointers for socket operations in proto_ops structures, which allows local users to trigger a NULL pointer dereference and gain privileges by using mmap to map page zero, placing arbitrary code on this page, and then invoking an unavailable operation, as demonstrated by the sendpage operation (sock_sendpage function) on a PF_PPPOX socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2693 
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-28T20:00:00.000Z
CVE-2009-2694 
The msn_slplink_process_msg function in libpurple/protocols/msn/slplink.c in libpurple, as used in Pidgin (formerly Gaim) before 2.5.9 and Adium 1.3.5 and earlier, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by sending multiple crafted SLP (aka MSNSLP) messages to trigger an overwrite of an arbitrary memory location.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1376.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T22:00:00.000Z
CVE-2009-2695 
The Linux kernel before 2.6.31-rc7 does not properly prevent mmap operations that target page zero and other low memory addresses, which allows local users to gain privileges by exploiting NULL pointer dereference vulnerabilities, related to (1) the default configuration of the allow_unconfined_mmap_low boolean in SELinux on Red Hat Enterprise Linux (RHEL) 5, (2) an error that causes allow_unconfined_mmap_low to be ignored in the unconfined_t domain, (3) lack of a requirement for the CAP_SYS_RAWIO capability for these mmap operations, and (4) interaction between the mmap_min_addr protection mechanism and certain application programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-28T15:00:00.000Z
CVE-2009-2696 
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-05T18:00:00.000Z
CVE-2009-2697 
The Red Hat build script for the GNOME Display Manager (GDM) before 2.16.0-56 on Red Hat Enterprise Linux (RHEL) 5 omits TCP Wrapper support, which might allow remote attackers to bypass intended access restrictions via XDMCP connections, a different vulnerability than CVE-2007-5079.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-04T20:00:00.000Z
CVE-2009-2698 
The udp_sendmsg function in the UDP implementation in (1) net/ipv4/udp.c and (2) net/ipv6/udp.c in the Linux kernel before 2.6.19 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via vectors involving the MSG_MORE flag and a UDP socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-27T17:00:00.000Z
CVE-2009-2699 
The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache Portable Runtime (APR) library before 1.3.9, as used in the Apache HTTP Server before 2.2.14 and other products, does not properly handle errors, which allows remote attackers to cause a denial of service (daemon hang) via unspecified HTTP requests, related to the prefork and event MPMs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-13T10:00:00.000Z
CVE-2009-2700 
src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-02T17:00:00.000Z
CVE-2009-2701 
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T18:00:00.000Z
CVE-2009-2702 
KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T18:00:00.000Z
CVE-2009-2703 
libpurple/protocols/irc/msgs.c in the IRC protocol plugin in libpurple in Pidgin before 2.6.2 allows remote IRC servers to cause a denial of service (NULL pointer dereference and application crash) via a TOPIC message that lacks a topic string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T18:00:00.000Z
CVE-2009-2704 
CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing a %00 (encoded null byte).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T10:00:00.000Z
CVE-2009-2705 
CA SiteMinder allows remote attackers to bypass cross-site scripting (XSS) protections for J2EE applications via a request containing non-canonical, "overlong Unicode" in place of blacklisted characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T10:00:00.000Z
CVE-2009-2707 
Unspecified vulnerability in ia32el (aka the IA 32 emulation functionality) before 7042_7022-0.4.2 in SUSE Linux Enterprise (SLE) 10 SP2 on Itanium IA64 machines allows local users to cause a denial of service (system crash) via a 32-bit x86 application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-2711 
XScreenSaver in Sun Solaris 9 and 10, OpenSolaris before snv_120, and X11 6.4.1 for Solaris 8, when the Xorg or Xnewt server is used, allows physically proximate attackers to obtain sensitive information by reading popup windows, which are displayed even when the screen is locked, a different vulnerability than CVE-2009-1276.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2009-2712 
Sun Java System Access Manager 6.3 2005Q1, 7.0 2005Q4, and 7.1; and OpenSSO Enterprise 8.0; when AMConfig.properties enables the debug flag, allows local users to discover cleartext passwords by reading debug files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2009-2713 
The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2009-2714 
Unspecified vulnerability in Sun VirtualBox 3.0.0 and 3.0.2 allows guest OS users to cause a denial of service (host OS reboot) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2009-2715 
Sun VirtualBox 2.2 through 3.0.2 r49928 allows guest OS users to cause a denial of service (Linux host OS reboot) via a sysenter instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-07T18:33:00.000Z
CVE-2009-2716 
The plugin functionality in Sun Java SE 6 before Update 15 does not properly implement version selection, which allows context-dependent attackers to leverage vulnerabilities in "old zip and certificate handling" and have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2717 
The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on Windows 2000 Professional does not provide a Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2718 
The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 before Update 15 on X11 does not impose the intended constraint on distance from the window border to the Security Warning Icon, which makes it easier for context-dependent attackers to trick a user into interacting unsafely with an untrusted applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2719 
The Java Web Start implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException) via a crafted .jnlp file, as demonstrated by the jnlp_file/appletDesc/index.html#misc test in the Technology Compatibility Kit (TCK) for the Java Network Launching Protocol (JNLP).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2720 
Unspecified vulnerability in the javax.swing.plaf.synth.SynthContext.isSubregion method in the Swing implementation in Sun Java SE 6 before Update 15 allows context-dependent attackers to cause a denial of service (NullPointerException in the Jemmy library) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2721 
Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6406003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2722 
Multiple unspecified vulnerabilities in the Provider class in Sun Java SE 5.0 before Update 20 have unknown impact and attack vectors, aka BugId 6429594.  NOTE: this issue exists because of an incorrect fix for BugId 6406003.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2723 
Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2724 
Race condition in the java.lang package in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, related to a "3Y Race condition in reflection checks."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T20:00:00.000Z
CVE-2009-2726 
The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x before 1.3.0.3 does not use a maximum width when invoking sscanf style functions, which allows remote attackers to cause a denial of service (stack memory consumption) via SIP packets containing large sequences of ASCII decimal characters, as demonstrated via vectors related to (1) the CSeq value in a SIP header, (2) large Content-Length value, and (3) SDP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2009-2727 
Stack-based buffer overflow in the _tt_internal_realpath function in the ToolTalk library (libtt.a) in IBM AIX 5.2.0, 5.3.0, 5.3.7 through 5.3.10, and 6.1.0 through 6.1.3, when the rpc.ttdbserver daemon is enabled in /etc/inetd.conf, allows remote attackers to execute arbitrary code via a long XDR-encoded ASCII string to remote procedure 15.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-10T23:00:00.000Z
CVE-2009-2730 
libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-12T10:00:00.000Z
CVE-2009-2732 
The checkHTTPpassword function in http.c in ntop 3.3.10 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an Authorization HTTP header that lacks a : (colon) character in the base64-decoded string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-20T22:00:00.000Z
CVE-2009-2733 
Multiple cross-site scripting (XSS) vulnerabilities in Achievo before 1.4.0 allow remote attackers to inject arbitrary web script or HTML via (1) the scheduler title in the scheduler module, and the (2) atksearch[contractnumber], (3) atksearch_AE_customer[customer], (4) atksearchmode[contracttype], and possibly (5) atksearch[contractname] parameters to the Organization Contracts administration page, reachable through dispatch.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-16T16:00:00.000Z
CVE-2009-2734 
SQL injection vulnerability in the get_employee function in classweekreport.inc in Achievo before 1.4.0 allows remote attackers to execute arbitrary SQL commands via the userid parameter (aka user_id variable) to dispatch.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-16T16:00:00.000Z
CVE-2009-2735 
SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T10:00:00.000Z
CVE-2009-2736 
Static code injection vulnerability in admin.php in sun-jester OpenNews 1.0 allows remote authenticated administrators to inject arbitrary PHP code into config.php via the "Overall Width" field in a setconfig action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T10:00:00.000Z
CVE-2009-2737 
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T10:00:00.000Z
CVE-2009-2738 
Cross-site request forgery (CSRF) vulnerability in the WebGUI in FreeNAS before 0.7RC1 allows remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T18:00:00.000Z
CVE-2009-2739 
Cross-site scripting (XSS) vulnerability in FreeNAS before 0.69.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-11T18:00:00.000Z
CVE-2009-2740 
kmxIds.sys before 7.3.1.18 in CA Host-Based Intrusion Prevention System (HIPS) 8.1 allows remote attackers to cause a denial of service (system crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-19T17:00:00.000Z
CVE-2009-2741 
Unspecified vulnerability in the wberuntimeear application in the test servlet in IBM WebSphere Business Events 6.1 and 6.2 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T22:00:00.000Z
CVE-2009-2742 
Cross-site scripting (XSS) vulnerability in Eclipse Help in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to inject arbitrary web script or HTML via unspecified input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-21T19:00:00.000Z
CVE-2009-2743 
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 before 7.0.0.7, does not properly handle an exception occurring after use of wsadmin scripts and configuration of JAAS-J2C Authentication Data, which allows local users to obtain sensitive information by reading the First Failure Data Capture (FFDC) log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-21T19:00:00.000Z
CVE-2009-2744 
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27 allows remote attackers to cause a denial of service via unknown vectors, related to "an error in fixpacks 6.1.0.23 and 6.1.0.25."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-21T19:00:00.000Z
CVE-2009-2746 
Cross-site request forgery (CSRF) vulnerability in the administrative console in the Security component in IBM WebSphere Application Server (WAS) 6.0.2 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-16T19:00:00.000Z
CVE-2009-2747 
The Java Naming and Directory Interface (JNDI) implementation in IBM WebSphere Application Server (WAS) 6.0 before 6.0.2.39, 6.1 before 6.1.0.29, and 7.0 before 7.0.0.7 does not properly restrict access to UserRegistry object methods, which allows remote attackers to obtain sensitive information via a crafted method call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-30T10:00:00.000Z
CVE-2009-2748 
Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.29 and 7.1 before 7.0.0.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-30T10:00:00.000Z