rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-4821 
The D-Link DIR-615 with firmware 3.10NA does not require administrative authentication for apply.cgi, which allows remote attackers to (1) change the admin password via the admin_password parameter, (2) disable the security requirement for the Wi-Fi network via unspecified vectors, or (3) modify DNS settings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4822 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kasseler CMS 1.3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) do, (2) id, and (3) uname parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4823 
Cross-site scripting (XSS) vulnerability in frontend/x3/files/fileop.html in cPanel 11.0 through 11.24.7 allows remote attackers to inject arbitrary web script or HTML via the fileop parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4824 
Unspecified vulnerability in Kolab Webclient before 1.2.0 in Kolab Server before 2.2.3 allows attackers to have an unspecified impact via vectors related to an "image upload form."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4825 
8pixel.net Blog 4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for App_Data/sb.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4826 
Cross-site request forgery (CSRF) vulnerability in hosting/admin_ac.php in ScriptsEz Mini Hosting Panel allows remote attackers to hijack the authentication of administrators for requests that alter administrative settings via a cp action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4827 
Cross-site request forgery (CSRF) vulnerability in admin.php in Mail Manager Pro allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a change action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4828 
Cross-site request forgery (CSRF) vulnerability in administration/admins.php in Ad Manager Pro (aka AdManagerPro) 3.0 allows remote attackers to hijack the authentication of administrators for requests that create new administrative users via an admin_created action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4829 
Cross-site scripting (XSS) vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with administer autologout privileges to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4830 
Unspecified vulnerability in OpenX 2.8.1 and 2.8.2 allows remote attackers to bypass authentication and obtain access to an Administrator account via unknown vectors, possibly related to www/admin/install.php, www/admin/install-plugins.php, and other www/admin/ files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-27T15:00:00.000Z
CVE-2009-4831 
Cerulean Studios Trillian 3.1 Basic does not check SSL certificates during MSN authentication, which allows remote attackers to obtain MSN credentials via a man-in-the-middle attack with a spoofed SSL certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-29T19:00:00.000Z
CVE-2009-4832 
The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows local users to gain privileges via a crafted IOCTL 0x80012010 request to the DLPCryptCore device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-29T19:00:00.000Z
CVE-2009-4833 
MySQL Connector/NET before 6.0.4, when using encryption, does not verify SSL certificates during connection, which allows remote attackers to perform a man-in-the-middle attack with a spoofed SSL certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-29T19:00:00.000Z
CVE-2009-4834 
lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute arbitrary PHP code via a crafted parameter name, possibly related to now_connect.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-04T15:00:00.000Z
CVE-2009-4835 
The (1) htk_read_header, (2) alaw_init, (3) ulaw_init, (4) pcm_init, (5) float32_init, and (6) sds_read_header functions in libsndfile 1.0.20 allow context-dependent attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted audio file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T18:00:00.000Z
CVE-2009-4836 
Eval injection vulnerability in system/services/init.php in Movie PHP Script 2.0 allows remote attackers to execute arbitrary PHP code via the anticode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T18:00:00.000Z
CVE-2009-4837 
Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) sig[1] parameter to base/base_qry_main.php, or the time[0][1] parameter to (2) base/base_stat_alerts.php or (3) base/base_stat_uaddr.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T18:00:00.000Z
CVE-2009-4838 
SQL injection vulnerability in base_ag_common.php in Basic Analysis and Security Engine (BASE) before 1.4.3.1 allows remote attackers to execute arbitrary SQL commands via unspecified parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T18:00:00.000Z
CVE-2009-4839 
Multiple cross-site scripting (XSS) vulnerabilities in Basic Analysis and Security Engine (BASE), possibly 1.4.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) admin/base_roleadmin.php, (2) admin/base_useradmin.php, (3) base_conf_contents.php, (4) base_qry_sqlcalls.php, and (5) base_ag_main.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T18:00:00.000Z
CVE-2009-4840 
Heap-based buffer overflow in the IAManager ActiveX control in IAManager.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the SetIAPlayerName method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T18:00:00.000Z
CVE-2009-4841 
Heap-based buffer overflow in the SonicMediaPlayer ActiveX control in SonicMediaPlayer.dll in Roxio CinePlayer 3.2 allows remote attackers to execute arbitrary code via a long argument to the DiskType method. NOTE: this might overlap CVE-2007-1559.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-05T18:00:00.000Z
CVE-2009-4842 
Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) addNewDept, (2) deptId, or (3) deptDesc parameter to tvserver/server/user/addDepartment.jsp; or the (4) firstName, (5) lastName, or (6) email parameter in a save action to tvserver/user/user.do.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T17:43:00.000Z
CVE-2009-4843 
ToutVirtual VirtualIQ Pro before 3.5 build 8691 does not require administrative authentication for JBoss console access, which allows remote attackers to execute arbitrary commands via requests to (1) the JMX Management Console or (2) the Web Console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T17:43:00.000Z
CVE-2009-4844 
ToutVirtual VirtualIQ Pro 3.2 build 7882 does not restrict access to the /status URI on port 9080, which allows remote attackers to obtain sensitive Tomcat information via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T17:43:00.000Z
CVE-2009-4845 
The configuration page in ToutVirtual VirtualIQ Pro 3.2 build 7882 contains cleartext SSH credentials, which allows remote attackers to obtain sensitive information by reading the username and password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T17:43:00.000Z
CVE-2009-4846 
Multiple buffer overflows in Deliantra Server before 2.82 allow remote attackers to execute arbitrary code via vectors related to (1) the command_gsay function in server/c_party.C and (2) the book implementation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4847 
Deliantra Server before 2.82 allows remote authenticated users to cause a denial of service (daemon crash) via vectors involving an empty treasure list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4848 
Multiple cross-site scripting (XSS) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to inject arbitrary web script or HTML via the (1) userId parameter to tvserver/server/user/setPermissions.jsp, (2) deptName parameter to tvserver/server/user/addDepartment.jsp, (3) ID parameter to tvserver/server/inventory/inventoryTabs.jsp, (4) reportName parameter to tvserver/reports/virtualIQAdminReports.do, or (5) middleName parameter in a save action to tvserver/user/user.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4849 
Multiple cross-site request forgery (CSRF) vulnerabilities in ToutVirtual VirtualIQ Pro 3.2 build 7882 and 3.5 build 8691 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new user account via a save action to tvserver/user/user.do, (2) shutdown a virtual machine, (3) start a virtual machine, (4) restart a virtual machine, or (5) schedule an activity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4850 
The Awingsoft Awakening Winds3D Viewer plugin 3.5.0.9 allows remote attackers to execute arbitrary programs via a SceneURL property value with a URL for a .exe file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4851 
The activation resend function in the Profiles module in XOOPS before 2.4.1 sends activation codes in response to arbitrary activation requests, which allows remote attackers to bypass administrative approval via a request involving activate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4852 
Multiple cross-site scripting (XSS) vulnerabilities in SemanticScuttle before 0.94.1 allow remote attackers to inject arbitrary web script or HTML via the sort parameter to index.php, and other unspecified vectors, a different issue than CVE-2008-6113.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4853 
Multiple cross-site scripting (XSS) vulnerabilities in JumpBox before 1.1.2 for Foswiki Wiki System allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T18:23:00.000Z
CVE-2009-4854 
addons/import.php in TalkBack 2.3.14 allows remote attackers to execute arbitrary commands via the result parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-07T22:00:00.000Z
CVE-2009-4855 
SQL injection vulnerability in index.php in TYPO3 4.0 allows remote attackers to execute arbitrary SQL commands via the showUid parameter. NOTE: the TYPO3 Security Team disputes this report, stating that "there is no such vulnerability... The showUid parameter is generally used in third-party TYPO3 extensions - not in TYPO3 Core.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4856 
Cross-site scripting (XSS) vulnerability in subitems.php in PHP Easy Shopping Cart 3.1R allows remote attackers to inject arbitrary web script or HTML via the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4857 
Cross-site scripting (XSS) vulnerability in login.php in PHP Photo Vote 1.3F allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4858 
Cross-site scripting (XSS) vulnerability in questiondetail.php in Yahoo Answers Clone allows remote attackers to inject arbitrary web script or HTML via the questionid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4859 
Multiple cross-site scripting (XSS) vulnerabilities in Online Work Order Suite (OWOS) Lite Edition 3.10 allow remote attackers to inject arbitrary web script or HTML via the show parameter to (1) default.asp and (2) report.asp, and the (3) go parameter to login.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4860 
SQL injection vulnerability in demo.php in Typing Pal 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the idTableProduit parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4861 
Cross-site scripting (XSS) vulnerability in shownews.php in SupportPRO SupportDesk 3.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4862 
Multiple SQL injection vulnerabilities in Alwasel 1.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) show.php and (2) xml.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4863 
Stack-based buffer overflow in UltraPlayer Media Player 2.112 allows remote attackers to execute arbitrary code via a long string in a .usk file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4864 
Multiple cross-site scripting (XSS) vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script allow remote attackers to inject arbitrary web script or HTML via the (1) search_name and (2) languages parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4865 
Multiple SQL injection vulnerabilities in escorts_search.php in I-Escorts Directory Script and Agency Script, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) search_name and (2) languages parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4866 
Cross-site scripting (XSS) vulnerability in search.cgi in Matt's Script Archive (MSA) Simple Search 1.0 allows remote attackers to inject arbitrary web script or HTML via the terms parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4867 
Buffer overflow in Tuniac 090517c allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long URL in a .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4868 
Cross-site scripting (XSS) vulnerability in Hitron Soft Answer Me 1.0 allows remote attackers to inject arbitrary web script or HTML via the q_id parameter to the answers script (aka answers.php).  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4869 
Cross-site scripting (XSS) vulnerability in index.php in Nasim Guest Book 1.2 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4870 
Multiple SQL injection vulnerabilities in login.php in PHPCityPortal allow remote attackers to execute arbitrary SQL commands via the (1) req_username (aka Username) and (2) req_password (aka Password) parameters.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4871 
SQL injection vulnerability in globepersonnel_forum.asp in Logoshows BBS 2.0 allows remote attackers to execute arbitrary SQL commands via the forumid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4872 
Multiple SQL injection vulnerabilities in globepersonnel_login.asp in Logoshows BBS 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-10T20:00:00.000Z
CVE-2009-4873 
Stack-based buffer overflow in the HTTP server in Rhino Software Serv-U Web Client 9.0.0.5 allows remote attackers to cause a denial of service (server crash) or execute arbitrary code via a long Session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-26T18:00:00.000Z
CVE-2009-4874 
TalkBack 2.3.14 does not properly restrict access to the edit comment feature (comments.php), which allows remote attackers to modify comments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-26T18:00:00.000Z
CVE-2009-4875 
FCKeditor.Java 2.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed request parameter that contains "ctrl" characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-26T18:00:00.000Z
CVE-2009-4876 
admin/cikkform.php in Netrix CMS 1.0 allows remote attackers to modify arbitrary pages via a direct request using the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-26T18:00:00.000Z
CVE-2009-4877 
Multiple cross-site request forgery (CSRF) vulnerabilities in WebGUI before 7.7.14 allow remote attackers to hijack the authentication of users for unspecified requests via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-26T18:00:00.000Z
CVE-2009-4878 
Unspecified vulnerability in the Administration Console in Novell Access Manager before 3.1 SP1 allows attackers to access system files via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-26T18:00:00.000Z
CVE-2009-4879 
The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-26T18:00:00.000Z
CVE-2009-4880 
Multiple integer overflows in the strfmon implementation in the GNU C Library (aka glibc or libc6) 2.10.1 and earlier allow context-dependent attackers to cause a denial of service (memory consumption or application crash) via a crafted format string, as demonstrated by a crafted first argument to the money_format function in PHP, a related issue to CVE-2008-1391.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T20:00:00.000Z
CVE-2009-4881 
Integer overflow in the __vstrfmon_l function in stdlib/strfmon_l.c in the strfmon implementation in the GNU C Library (aka glibc or libc6) before 2.10.1 allows context-dependent attackers to cause a denial of service (application crash) via a crafted format string, as demonstrated by the %99999999999999999999n string, a related issue to CVE-2008-1391.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T20:00:00.000Z
CVE-2009-4882 
Cross-site scripting (XSS) vulnerability in zc/publisher/html.rb in ZoneCheck 2.0.4-13 and 2.1.0 allows remote attackers to inject arbitrary web script or HTML via the ns parameter to zc.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T19:00:00.000Z
CVE-2009-4883 
SQL injection vulnerability in index.php in PHPRecipeBook 2.24 and 2.39 allows remote attackers to execute arbitrary SQL commands via the (1) base_id or (2) course_id parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T14:00:00.000Z
CVE-2009-4884 
Multiple SQL injection vulnerabilities in phpCommunity 2 2.1.8, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via (1) the forum_id parameter in a forum action to index.php, (2) the topic_id parameter in a forum action to index.php, (3) the wert parameter in an id search action to index.php, (4) the wert parameter in a nick search action to index.php, or (5) the wert parameter in a forum search action to index.php, related to class_forum.php and class_search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T14:00:00.000Z
CVE-2009-4885 
Cross-site scripting (XSS) vulnerability in templates/1/login.php in phpCommunity 2 2.1.8 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T14:00:00.000Z
CVE-2009-4886 
Multiple directory traversal vulnerabilities in phpCommunity 2 2.1.8 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) file parameter to module/admin/files/show_file.php and the (2) path parameter to module/admin/files/show_source.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-11T14:00:00.000Z