rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-2555 
Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a crafted JavaScript regular expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T16:00:00.000Z
CVE-2009-2556 
Google Chrome before 2.0.172.37 allows attackers to leverage renderer access to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger excessive memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T16:00:00.000Z
CVE-2009-2557 
Directory traversal vulnerability in system/download.php in Admin News Tools 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the fichier parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2558 
system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news messages via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2559 
Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an array index error.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2560 
Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2561 
Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2562 
Unspecified vulnerability in the AFS dissector in Wireshark 0.9.2 through 1.2.0 allows remote attackers to cause a denial of service (crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2563 
Unspecified vulnerability in the Infiniband dissector in Wireshark 1.0.6 through 1.2.0, when running on unspecified platforms, allows remote attackers to cause a denial of service (crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2564 
NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T17:00:00.000Z
CVE-2009-2565 
Cross-site scripting (XSS) vulnerability in Perl CGI's By Mrs. Shiromuku shiromuku(fs6)DIARY 2.40 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T22:00:00.000Z
CVE-2009-2566 
Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-21T22:00:00.000Z
CVE-2009-2567 
SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2568 
Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2569 
Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inject arbitrary web script or HTML via (1) the nick parameter in a login action to index.php or (2) the URI in a news request to index.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2570 
Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2571 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the URI, (2) the q parameter, (3) the nick parameter, or (4) the nick parameter in a bantest action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2572 
Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2573 
Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via the (1) user parameter to (a) index.php and (b) rss.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2574 
index.php in MiniTwitter 0.2 beta allows remote authenticated users to modify certain options of arbitrary accounts via an opt action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T17:09:00.000Z
CVE-2009-2575 
The Research In Motion (RIM) BlackBerry 8800 allows remote attackers to cause a denial of service (memory consumption and browser crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T18:00:00.000Z
CVE-2009-2576 
Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.  NOTE: it was later reported that 7.0.6000.16473 and earlier are also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T18:00:00.000Z
CVE-2009-2577 
Opera 9.52 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption, and application hang) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T18:00:00.000Z
CVE-2009-2578 
Google Chrome 2.x through 2.0.172 allows remote attackers to cause a denial of service (application crash) via a long Unicode string argument to the write method, a related issue to CVE-2009-2479.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-22T18:00:00.000Z
CVE-2009-2579 
SQL injection vulnerability in reward_points.post.php in the Reward points addon in CS-Cart before 2.0.6 allows remote authenticated users to execute arbitrary SQL commands via the sort_order parameter in a reward_points.userlog action to index.php, a different vulnerability than CVE-2005-4429.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-05T19:00:00.000Z
CVE-2009-2581 
Cross-site scripting (XSS) vulnerability in modifier.php in EditeurScripts EsNews 1.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T19:00:00.000Z
CVE-2009-2582 
Stack-based buffer overflow in manager.exe in Akamai Download Manager (aka DLM or dlmanager) before 2.2.4.8 allows remote web servers to execute arbitrary code via a malformed HTTP response during a Redswoosh download, a different vulnerability than CVE-2007-1891 and CVE-2007-1892.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T20:00:00.000Z
CVE-2009-2583 
Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the (1) console and (2) self service interfaces.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T20:00:00.000Z
CVE-2009-2584 
Off-by-one error in the options_write function in drivers/misc/sgi-gru/gruprocfs.c in the SGI GRU driver in the Linux kernel 2.6.30.2 and earlier on ia64 and x86 platforms might allow local users to overwrite arbitrary memory locations and gain privileges via a crafted count argument, which triggers a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-23T20:00:00.000Z
CVE-2009-2585 
SQL injection vulnerability in index.php in Mlffat 2.2 allows remote attackers to execute arbitrary SQL commands via a member cookie in an account editprofile action, a different vector than CVE-2009-1731.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2586 
Cross-site scripting (XSS) vulnerability in articles.php in EDGEPHP EZArticles allows remote attackers to inject arbitrary web script or HTML via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2587 
Multiple cross-site scripting (XSS) vulnerabilities in DragDropCart allow remote attackers to inject arbitrary web script or HTML via the (1) sid parameter to assets/js/ddcart.php, the (2) prefix parameter to includes/ajax/getstate.php, the search parameter to (3) index.php and (4) search.php, the (5) redirect parameter to login.php, and the (6) product parameter to productdetail.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2588 
Multiple cross-site scripting (XSS) vulnerabilities in Hotscripts Type PHP Clone Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2589 
Multiple cross-site scripting (XSS) vulnerabilities in Hutscripts PHP Website Script allow remote attackers to inject arbitrary web script or HTML via the msg parameter to (1) feedback.php, (2) index.php, and (3) lostpassword.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2590 
SQL injection vulnerability in showcategory.php in Hutscripts PHP Website Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2591 
SQL injection vulnerability in the MyAnnonces module for E-Xoopport 3.1 allows remote attackers to execute arbitrary SQL commands via the lid parameter in a viewannonces action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2592 
SQL injection vulnerability in guestbook.php in PHPJunkYard GBook 1.6 allows remote attackers to execute arbitrary SQL commands via the mes_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2593 
SQL injection vulnerability in censura.php in Censura 1.16.04 allows remote attackers to execute arbitrary SQL commands via the itemid parameter in a details action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2594 
Cross-site scripting (XSS) vulnerability in censura.php in Censura 1.16.04 allows remote attackers to inject arbitrary web script or HTML via the itemid parameter in a details action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2595 
Cross-site scripting (XSS) vulnerability in productSearch.html in Censura 2.0.4 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a ProductSearch action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-24T16:00:00.000Z
CVE-2009-2596 
Unspecified vulnerability in the Solaris Auditing subsystem in Sun Solaris 9 and 10 and OpenSolaris before snv_121, when extended file attributes are used, allows local users to cause a denial of service (panic) via vectors related to fad_aupath structure members.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2597 
The Sun Java System (SJS) Access Manager Policy Agent module 2.2 for SJS Web Proxy Server 4.0 allows remote attackers to cause a denial of service (daemon crash) via a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2598 
Multiple SQL injection vulnerabilities in Online Grades & Attendance 3.2.6 and earlier allow (1) remote attackers to execute arbitrary SQL commands via the key parameter in a resetpass action to index.php and (2) remote authenticated users to execute arbitrary SQL commands via the ADD parameter in a mailto action to parents/parents.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2599 
SQL injection vulnerability in index.php in RadCLASSIFIEDS Gold 2.0 allows remote attackers to execute arbitrary SQL commands via the seller parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2600 
Multiple directory traversal vulnerabilities in view.php in Webboard 2.90 beta and earlier allow remote attackers to read arbitrary files via a .. (dot dot) in the topic parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2601 
SQL injection vulnerability in the Joomlaequipment (aka JUser or com_juser) component 2.0.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a show_profile action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2602 
R2 Newsletter Lite, Pro, and Stats stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for admin.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2603 
Multiple SQL injection vulnerabilities in index.php in Escon SupportPortal Pro 3.0 allow remote attackers to execute arbitrary SQL commands via the (1) cat and (2) tid parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2604 
Multiple SQL injection vulnerabilities in adminlogin.asp in Zen Help Desk 2.1 allow remote attackers to execute arbitrary SQL commands via the (1) userid (aka username) and (2) PassWord parameters to admin.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2605 
Multiple SQL injection vulnerabilities in adminquery.php in Traidnt Up 2.0 allow remote attackers to execute arbitrary SQL commands via (1) trupuser and (2) truppassword cookies to uploadcp/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2606 
ASP Football Pool 2.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for NFL.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T14:22:00.000Z
CVE-2009-2607 
SQL injection vulnerability in the com_pinboard component for Joomla! allows remote attackers to execute arbitrary SQL commands via the task parameter in a showpic action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2608 
Multiple SQL injection vulnerabilities in PHP Address Book 4.0.x allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to delete.php or (2) alphabet parameter to index.php.  NOTE: the edit.php and view.php vectors are already covered by CVE-2008-2565.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2609 
SQL injection vulnerability in the amoCourse (com_amocourse) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2610 
Cross-site scripting (XSS) vulnerability in the Links Related module in the Links Package 5.x before 5.x-1.13 and 6.x before 6.x-1.2, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via the title field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2611 
Directory traversal vulnerability in infusions/last_seen_users_panel/last_seen_users_panel.php in MyFusion (aka MyF) 6 Beta, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the settings[locale] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2612 
SQL injection vulnerability in login.aspx in ProSMDR allows remote attackers to execute arbitrary SQL commands via the txtUser parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2613 
Multiple cross-site scripting (XSS) vulnerabilities in DataCheck Solutions LinkPal 1.x allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) z_loginfailed.asp, (2) z_admin_login.asp, (3) z_forgot.asp, and possibly unspecified other components.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2614 
SQL injection vulnerability in z_admin_login.asp in DataCheck Solutions LinkPal 1.x allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2615 
Multiple cross-site scripting (XSS) vulnerabilities in DataCheck Solutions SitePal 1.x allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) z_admin_login.asp, (2) z_forgot.asp, and possibly unspecified other components.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2616 
SQL injection vulnerability in z_admin_login.asp in DataCheck Solutions SitePal 1.x allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2617 
Stack-based buffer overflow in medialib.dll in BaoFeng Storm 3.9.62 allows remote attackers to execute arbitrary code via a long pathname in the source attribute of an item element in a .smpl playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2618 
SQL injection vulnerability in the Surveys (aka NS-Polls) module in MDPro (MD-Pro) 1.083.x allows remote attackers to execute arbitrary SQL commands via the pollID parameter in a results action to modules.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2619 
SQL injection vulnerability in login.asp in DataCheck Solutions V-SpacePal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-27T18:00:00.000Z
CVE-2009-2620 
src/remote/server.cpp in fbserver.exe in Firebird SQL 1.5 before 1.5.6, 2.0 before 2.0.6, 2.1 before 2.1.3, and 2.5 before 2.5 Beta 2 allows remote attackers to cause a denial of service (daemon crash) via a malformed op_connect_request message that triggers an infinite loop or NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-29T17:00:00.000Z
CVE-2009-2621 
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a) HttpMsg.cc and (b) client_side.cc.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-28T17:00:00.000Z