rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-2482 
LibTIFF 3.9.4 and earlier does not properly handle an invalid td_stripbytecount field, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted TIFF file, a different vulnerability than CVE-2010-2443.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-06T14:00:00.000Z
CVE-2010-2483 
The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a TIFF file with an invalid combination of SamplesPerPixel and Photometric values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-06T14:00:00.000Z
CVE-2010-2484 
The strrchr function in PHP 5.2 before 5.2.14 allows context-dependent attackers to obtain sensitive information (memory contents) or trigger memory corruption by causing a userspace interruption of an internal function or handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-20T20:00:00.000Z
CVE-2010-2487 
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, 1.8.x before 1.8.8, and 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) Page.py, (2) PageEditor.py, (3) PageGraphicalEditor.py, (4) action/CopyPage.py, (5) action/Load.py, (6) action/RenamePage.py, (7) action/backup.py, (8) action/login.py, (9) action/newaccount.py, and (10) action/recoverpass.py.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-04T21:00:00.000Z
CVE-2010-2488 
NULL pointer dereference vulnerability in ZNC before 0.092 caused by traffic stats when there are unauthenticated connections.
Problem types: description: null pointer deref
Affected products: vendor: znc
product: znc
Published: 2019-11-12T19:48:56.000Z
CVE-2010-2489 
Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-09T19:00:00.000Z
CVE-2010-2490 
Mumble: murmur-server has DoS due to malformed client query
Problem types: description: DoS via malformed client query
Affected products: vendor: n/a
product: n/a
Published: 2019-10-31T15:23:28.000Z
CVE-2010-2491 
Cross-site scripting (XSS) vulnerability in cgi/client.py in Roundup before 1.4.14 allows remote attackers to inject arbitrary web script or HTML via the template argument to the /issue program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-24T18:00:00.000Z
CVE-2010-2492 
Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-08T19:00:00.000Z
CVE-2010-2493 
The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-09T20:00:00.000Z
CVE-2010-2494 
Multiple buffer underflows in the base64 decoder in base64.c in (1) bogofilter and (2) bogolexer in bogofilter before 1.2.2 allow remote attackers to cause a denial of service (heap memory corruption and application crash) via an e-mail message with invalid base64 data that begins with an = (equals) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-08T18:00:00.000Z
CVE-2010-2495 
The pppol2tp_xmit function in drivers/net/pppol2tp.c in the L2TP implementation in the Linux kernel before 2.6.34 does not properly validate certain values associated with an interface, which allows attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors related to a routing change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-08T19:00:00.000Z
CVE-2010-2496 
stonith-ng in pacemaker and cluster-glue passed passwords as commandline parameters, making it possible for local attackers to gain access to passwords of the HA stack and potentially influence its operations. This is fixed in cluster-glue 1.0.6 and newer, and pacemaker 1.1.3 and newer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-18T12:12:42.000Z
CVE-2010-2497 
Integer underflow in glyph handling in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2498 
The psh_glyph_find_strong_points function in pshinter/pshalgo.c in FreeType before 2.4.0 does not properly implement hinting masks, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a crafted font file that triggers an invalid free operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2499 
Buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted LaserWriter PS font file with an embedded PFB fragment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2500 
Integer overflow in the gray_render_span function in smooth/ftgrays.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2502 
Multiple directory traversal vulnerabilities in Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allow (1) remote attackers to read arbitrary files, aka SPL-31194; (2) remote authenticated users to modify arbitrary files, aka SPL-31063; or (3) have an unknown impact via redirects, aka SPL-31067.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T18:06:00.000Z
CVE-2010-2503 
Multiple cross-site scripting (XSS) vulnerabilities in Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allow remote attackers to inject arbitrary web script or HTML via (1) redirects, aka SPL-31067; (2) unspecified "user->user or user->admin" vectors, aka SPL-31084; or (3) unspecified "user input," aka SPL-31085.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T18:06:00.000Z
CVE-2010-2504 
Splunk 4.0 through 4.0.10 and 4.1 through 4.1.1 allows remote authenticated users to obtain sensitive information via HTTP header injection, aka SPL-31066.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T18:06:00.000Z
CVE-2010-2505 
Soft SaschArt SasCAM Webcam Server 2.6.5, 2.7, and earlier allows remote attackers to cause a denial of service (crash) via a large number of requests with a long line, as demonstrated using a long GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T18:06:00.000Z
CVE-2010-2506 
Cross-site scripting (XSS) vulnerability in debug.cgi in Linksys WAP54Gv3 firmware 3.05.03 and 3.04.03 allows remote attackers to inject arbitrary web script or HTML via the data1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T18:06:00.000Z
CVE-2010-2507 
Directory traversal vulnerability in the Picasa2Gallery (com_picasa2gallery) component 1.2.8 and earlier for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2508 
SQL injection vulnerability in user-profile.php in 2daybiz Video Community Portal Script allows remote attackers to execute arbitrary SQL commands via the userid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2509 
Multiple cross-site scripting (XSS) vulnerabilities in 2daybiz Web Template Software allow remote attackers to inject arbitrary web script or HTML via the (1) keyword parameter to category.php and the (2) password parameter to memberlogin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2510 
SQL injection vulnerability in customize.php in 2daybiz Web Template Software allows remote attackers to execute arbitrary SQL commands via the tid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2511 
SQL injection vulnerability in viewnews.php in 2daybiz Multi Level Marketing (MLM) Software allows remote attackers to execute arbitrary SQL commands via the nwsid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2512 
SQL injection vulnerability in customprofile.php in 2daybiz Matrimonial Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2513 
SQL injection vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the view parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2514 
Cross-site scripting (XSS) vulnerability in the JFaq (com_jfaq) component 1.2 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the question parameter in an add2 action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2515 
Multiple SQL injection vulnerabilities in index.php in the JFaq (com_jfaq) component 1.2 for Joomla!, when magic_quotes_gpc is disabled, allow (1) remote attackers to execute arbitrary SQL commands via the id parameter, and (2) remote authenticated users with "Public Front-end" permissions to execute arbitrary SQL commands via the titlu parameter (title field).  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-28T20:00:00.000Z
CVE-2010-2516 
Multiple SQL injection vulnerabilities in 2daybiz Multi Level Marketing (MLM) Software allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) index.php and (2) admin/index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-29T18:00:00.000Z
CVE-2010-2517 
Multiple unspecified vulnerabilities in IBM Rational ClearQuest before 7.1.1.02 have unknown impact and attack vectors, as demonstrated by an AppScan report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2518 
Unspecified vulnerability in the P8 Content Engine (P8CE) 4.5.1 before FP3 and the P8 Content Search Engine (P8CSE) before 4.5.0 FP3 and 4.5.1 before FP1, as used in IBM FileNet P8 Content Manager (CM) and FileNet P8 Business Process Manager (BPM), allows remote attackers to gain privileges via unknown vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-30T18:00:00.000Z
CVE-2010-2519 
Heap-based buffer overflow in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.4.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted length value in a POST fragment header in a font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2520 
Heap-based buffer overflow in the Ins_IUP function in truetype/ttinterp.c in FreeType before 2.4.0, when TrueType bytecode support is enabled, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2521 
Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T16:30:00.000Z
CVE-2010-2522 
The mipv6 daemon in UMIP 0.4 does not verify that netlink messages originated in the kernel, which allows local users to spoof netlink socket communication via a crafted unicast message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-13T17:00:00.000Z
CVE-2010-2523 
Multiple buffer overflows in ha.c in the mipv6 daemon in UMIP 0.4 allow remote attackers to have an unspecified impact via a crafted (1) ND_OPT_PREFIX_INFORMATION or (2) ND_OPT_HOME_AGENT_INFO packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-13T17:00:00.000Z
CVE-2010-2524 
The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the dns_resolver upcall in the cifs.upcall userspace helper, which allows local users to spoof the results of DNS queries and perform arbitrary CIFS mounts via vectors involving an add_key call, related to a "cache stuffing" issue and MS-DFS referrals.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-08T19:00:00.000Z
CVE-2010-2525 
A flaw was discovered in gfs2 file system’s handling of acls (access control lists). An unprivileged local attacker could exploit this flaw to gain access or execute any file stored in the gfs2 file system.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: kernel
Published: 2021-06-22T11:39:48.000Z
CVE-2010-2526 
The cluster logical volume manager daemon (clvmd) in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System (GFS) and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service (daemon exit or logical-volume change) or possibly have unspecified other impact via crafted control commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-04T21:00:00.000Z
CVE-2010-2527 
Multiple buffer overflows in demo programs in FreeType before 2.4.0 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2528 
The clientautoresp function in family_icbm.c in the oscar protocol plugin in libpurple in Pidgin before 2.7.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via an X-Status message that lacks the expected end tag for a (1) desc or (2) title element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-29T18:00:00.000Z
CVE-2010-2529 
Unspecified vulnerability in ping.c in iputils 20020927, 20070202, 20071127, and 20100214 on Mandriva Linux allows remote attackers to cause a denial of service (hang) via a crafted echo response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-27T22:00:00.000Z
CVE-2010-2530 
Multiple integer signedness errors in smb_subr.c in the netsmb module in the kernel in NetBSD 5.0.2 and earlier, FreeBSD, and Apple Mac OS X allow local users to cause a denial of service (panic) via a negative size value in a /dev/nsmb ioctl operation, as demonstrated by a (1) SMBIOC_LOOKUP or (2) SMBIOC_OPENSESSION ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-29T16:00:00.000Z
CVE-2010-2531 
The var_export function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user when certain fatal errors occur, even if display_errors is off, which allows remote attackers to obtain sensitive information by causing the application to exceed limits for memory, execution time, or recursion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-20T20:00:00.000Z
CVE-2010-2532 
lxsession-logout in lxsession in LXDE, as used on SUSE openSUSE 11.3 and other platforms, does not lock the screen when the Suspend or Hibernate button is pressed, which might make it easier for physically proximate attackers to access an unattended laptop via a resume action. NOTE: there is no general agreement that this is a vulnerability, because separate control over locking can be an equally secure, or more secure, behavior in some threat environments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-03T19:00:00.000Z
CVE-2010-2534 
The NetworkSyncCommandQueue function in network/network_command.cpp in OpenTTD before 1.0.3 does not properly clear a pointer in a linked list, which allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted request, related to the client command queue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-27T22:00:00.000Z
CVE-2010-2535 
Multiple cross-site scripting (XSS) vulnerabilities in the Back End in Joomla! 1.5.x before 1.5.20 allow remote authenticated users to inject arbitrary web script or HTML via administrator screens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-2536 
Multiple cross-site scripting (XSS) vulnerabilities in rekonq 0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a URL associated with a nonexistent domain name, related to webpage.cpp, aka a "universal XSS" issue; (2) unspecified vectors related to webview.cpp; and the about: views for (3) favorites, (4) bookmarks, (5) closed tabs, and (6) history.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-02T20:00:00.000Z
CVE-2010-2537 
The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2) BTRFS_IOC_CLONE_RANGE ioctl call that specifies this file as a donor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-30T14:00:00.000Z
CVE-2010-2538 
Integer overflow in the btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 might allow local users to obtain sensitive information via a BTRFS_IOC_CLONE_RANGE ioctl call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-30T14:00:00.000Z
CVE-2010-2539 
Buffer overflow in the msTmpFile function in maputil.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 allows local users to cause a denial of service via vectors involving names of temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-02T21:00:00.000Z
CVE-2010-2540 
mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debugging, which allows remote attackers to have an unspecified impact via crafted arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-02T21:00:00.000Z
CVE-2010-2541 
Buffer overflow in ftmulti.c in the ftmulti demo program in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-19T17:43:00.000Z
CVE-2010-2542 
Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2543 
Cross-site scripting (XSS) vulnerability in include/top_graph_header.php in Cacti before 0.8.7g allows remote attackers to inject arbitrary web script or HTML via the graph_start parameter to graph.php.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-4032.2.b.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-23T20:00:00.000Z
CVE-2010-2544 
Cross-site scripting (XSS) vulnerability in utilities.php in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-23T20:00:00.000Z
CVE-2010-2545 
Multiple cross-site scripting (XSS) vulnerabilities in Cacti before 0.8.7g, as used in Red Hat High Performance Computing (HPC) Solution and other products, allow remote attackers to inject arbitrary web script or HTML via (1) the name element in an XML template to templates_import.php; and allow remote authenticated administrators to inject arbitrary web script or HTML via vectors related to (2) cdef.php, (3) data_input.php, (4) data_queries.php, (5) data_sources.php, (6) data_templates.php, (7) gprint_presets.php, (8) graph.php, (9) graphs_new.php, (10) graphs.php, (11) graph_templates_inputs.php, (12) graph_templates_items.php, (13) graph_templates.php, (14) graph_view.php, (15) host.php, (16) host_templates.php, (17) lib/functions.php, (18) lib/html_form.php, (19) lib/html_form_template.php, (20) lib/html.php, (21) lib/html_tree.php, (22) lib/rrd.php, (23) rra.php, (24) tree.php, and (25) user_admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-23T20:00:00.000Z