rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-2321 
cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to cause a denial of service (configuration reset) via a RESTORE=RESTORE query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2322 
Cross-site scripting (XSS) vulnerability in cgi-bin/sysconf.cgi on the Axesstel MV 410R allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2323 
The web interface on the Axesstel MV 410R redirects users back to the referring page after execution of some CGI scripts, which makes it easier for remote attackers to avoid detection of cross-site request forgery (CSRF) attacks, as demonstrated by a redirect from the cgi-bin/wireless.cgi script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2324 
Multiple cross-site scripting (XSS) vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to inject arbitrary web script or HTML via components in the samples (aka _samples) directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2325 
Directory traversal vulnerability in index.php in Clicknet CMS 2.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the side parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2326 
Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via (1) an enter_parol cookie to index.php in an auto action or (2) the topic parameter to message.php.  NOTE: vector 2 can be leveraged for a cross-site scripting (XSS) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2327 
Cross-site scripting (XSS) vulnerability in add_voting.php in KerviNet Forum 1.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the v_variant1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2328 
admin/edit_user.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the del_user_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2329 
KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to (1) admin/head.php, or (2) voting_diagram.php, (3) voting.php, (4) topics_search.php, (5) topics_list.php, (6) top_part.php, (7) quick_search.php, (8) quick_reply.php, (9) moder_menu.php, (10) messages_list.php, (11) menu.php, (12) head.php, (13) forums_list.php, (14) forum_statistics.php, (15) forum_info.php, or (16) birthday.php in include_files/, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2330 
Cross-site scripting (XSS) vulnerability in admin/admin_menu.php in CMS Chainuk 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the menu parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2331 
Multiple static code injection vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to inject arbitrary PHP code (1) into settings.php via the menu parameter to admin_settings.php or (2) into a content/=NUMBER.php file via the title parameter to admin_new.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2332 
CMS Chainuk 1.2 and earlier allows remote attackers to obtain sensitive information via (1) a crafted id parameter to index.php or (2) a nonexistent folder name in the id parameter to admin/admin_delete.php, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2333 
Multiple directory traversal vulnerabilities in CMS Chainuk 1.2 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the menu parameter to admin/admin_menu.php, and the id parameter to (2) index.php and (3) admin/admin_edit.php; and (4) delete arbitrary local files via a .. (dot dot) in the id parameter to admin/admin_delete.php.  NOTE: vector 2 can be leveraged for static code injection by sending a crafted menu parameter to admin/admin_menu.php, and then sending an id=../menu.csv request to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-05T16:00:00.000Z
CVE-2009-2334 
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access the configuration of a plugin, which allows remote attackers to specify a configuration file in the page parameter to obtain sensitive information or modify this file, as demonstrated by the (1) collapsing-archives/options.txt, (2) akismet/readme.txt, (3) related-ways-to-take-action/options.php, (4) wp-security-scan/securityscan.php, and (5) wp-ids/ids-admin.php files. NOTE: this can be leveraged for cross-site scripting (XSS) and denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T20:25:00.000Z
CVE-2009-2335 
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T20:25:00.000Z
CVE-2009-2336 
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password request depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.  NOTE: the vendor reportedly disputes the significance of this issue, indicating that the behavior exists for "user convenience."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-10T20:25:00.000Z
CVE-2009-2337 
SQL injection vulnerability in includes/module/book/index.inc.php in w3b|cms Gaestebuch Guestbook Module 3.0.0, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the spam_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2009-2338 
Directory traversal vulnerability in includes/startmodules.inc.php in FreeWebshop.org 2.2.9 R2, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T18:35:00.000Z
CVE-2009-2339 
SQL injection vulnerability in index.php in Rentventory allows remote attackers to execute arbitrary SQL commands via the product parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T19:00:00.000Z
CVE-2009-2340 
SQL injection vulnerability in admin/index.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the txtUserName (aka User Name) parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T19:00:00.000Z
CVE-2009-2341 
SQL injection vulnerability in albumdetail.php in Opial 1.0 allows remote attackers to execute arbitrary SQL commands via the albumid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T19:00:00.000Z
CVE-2009-2342 
Cross-site scripting (XSS) vulnerability in admin.php (aka the login page) in Content Management Made Easy (CMME) before 1.22 allows remote attackers to inject arbitrary web script or HTML via the username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T19:00:00.000Z
CVE-2009-2343 
Cross-site scripting (XSS) vulnerability in people.php in Zoph before 0.7.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T19:00:00.000Z
CVE-2009-2344 
The web-based management interfaces in Sourcefire Defense Center (DC) and 3D Sensor before 4.8.2 allow remote authenticated users to gain privileges via a $admin value for the admin parameter in an edit action to admin/user/user.cgi and unspecified other components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T19:00:00.000Z
CVE-2009-2345 
Multiple SQL injection vulnerabilities in ClanSphere before 2009.0.1 allow remote attackers to execute arbitrary SQL commands via unknown parameters to the gbook module and unspecified other components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T19:00:00.000Z
CVE-2009-2346 
The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; Business Edition B.x.x before B.2.5.10, C.2.x before C.2.4.3, and C.3.x before C.3.1.1; and s800i 1.3.x before 1.3.0.3 allows remote attackers to cause a denial of service (call-number exhaustion) by initiating many IAX2 message exchanges, a related issue to CVE-2008-3263.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-08T18:00:00.000Z
CVE-2009-2347 
Multiple integer overflows in inter-color spaces conversion tools in libtiff 3.8 through 3.8.2, 3.9, and 4.0 allow context-dependent attackers to execute arbitrary code via a TIFF image with large (1) width and (2) height values, which triggers a heap-based buffer overflow in the (a) cvt_whole_image function in tiff2rgba and (b) tiffcvt function in rgb2ycbcr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-14T20:16:00.000Z
CVE-2009-2348 
Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.CAMERA) and (2) Manifest.permission.AUDIO_RECORD (aka android.permission.RECORD_AUDIO) configuration settings by installing and executing an application that does not make a permission request before using the camera or microphone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-17T16:00:00.000Z
CVE-2009-2350 
Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2351 
Opera 9.52 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 10.00 Beta 3 Build 1699 is also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2352 
Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta are also affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2353 
encoder.php in eAccelerator allows remote attackers to execute arbitrary code by copying a local executable file to a location under the web root via the -o option, and then making a direct request to this file, related to upload of image files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2354 
SQL injection vulnerability in the auth_checkpass function in the login page in NullLogic Groupware 1.2.7 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2355 
The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service (application crash) by specifying (1) an empty string or (2) a non-numeric string when selecting a forum, related to the fmessagelist function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2356 
Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the (1) POP3, (2) SMTP, or (3) web component that triggers a long SQL query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2357 
The default configuration of TekRADIUS 3.0 uses the sa account to communicate with Microsoft SQL Server, which makes it easier for remote attackers to obtain privileged access to the database and the underlying Windows operating system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2358 
TekRADIUS 3.0 uses BUILTIN\Users:R permissions for the TekRADIUS.ini file, which allows local users to obtain obfuscated database credentials by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2359 
Multiple SQL injection vulnerabilities in TekRADIUS 3.0 allow context-dependent attackers to execute arbitrary SQL commands via (1) the GUI client, as demonstrated by input to the Browse Users text box in the Users tab; or (2) the command-line client, as demonstrated by a certain trcli -r command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-07T23:00:00.000Z
CVE-2009-2360 
Cross-site scripting (XSS) vulnerability in passwd/main.php in the Passwd module before 3.1.1 for Horde allows remote attackers to inject arbitrary web script or HTML via the backend parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2361 
SQL injection vulnerability in include/class.staff.php in osTicket before 1.6 RC5 allows remote attackers to execute arbitrary SQL commands via the staff username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2362 
Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.0.0.215 allows remote attackers to execute arbitrary code via a long string in a (1) .lst or (2) .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2363 
Stack-based buffer overflow in KUDRSOFT AudioPLUS 2.00.215 allows remote attackers to execute arbitrary code via a .pls playlist file with a playlist entry containing a long File1 argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2364 
Stack-based buffer overflow in Mp3-Nator 2.0 allows remote attackers to execute arbitrary code via (1) a long string in a .plf file and (2) a long string in the listdata.dat file, possibly related to a track entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2365 
SQL injection vulnerability in login.asp in DataCheck Solutions GalleryPal FE 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2366 
SQL injection vulnerability in login.asp in DataCheck Solutions ForumPal FE 1.1 and ForumPal 1.5 allows remote attackers to execute arbitrary SQL commands via the (1) password parameter in 1.1 and (2) p_password parameter in 1.5.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2367 
cgi-bin/makecgi-pro in Iomega StorCenter Pro generates predictable session IDs, which allows remote attackers to hijack active sessions and gain privileges via brute force guessing attacks on the session_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2368 
Unspecified vulnerability in Socks Server 5 before 3.7.8-8 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2369 
Integer overflow in the wxImage::Create function in src/common/image.cpp in wxWidgets 2.8.10 allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted JPEG file, which triggers a heap-based buffer overflow.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2370 
Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2371 
Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2372 
Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2373 
Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2374 
Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from those links or (2) when page caching is enabled, the Drupal page cache.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2375 
Stack-based buffer overflow in Photo DVD Maker 8.02, and possibly earlier versions, allows remote attackers to execute arbitrary code via a long File_Name parameter in a .pdm file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2376 
Cross-site scripting (XSS) vulnerability in the Html::textarea function in application/libraries/Html.php in TangoCMS 2.x before 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the value parameter, related to the Contact module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2377 
Buffer overflow in the Avax Vector ActiveX control in avPreview.ocx in AVAX-software Avax Vector ActiveX 1.3 allows remote attackers to cause a denial of service (application crash) via a long PrinterName property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2378 
PHP remote file inclusion vulnerability in formmailer.admin.inc.php in Jax FormMailer 3.0.0 allows remote attackers to execute arbitrary PHP code via a URL in the BASE_DIR[jax_formmailer] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2379 
Directory traversal vulnerability in public/index.php in BIGACE Web CMS 2.6 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cmd parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2380 
Cross-site scripting (XSS) vulnerability in includes/functions.php in 4images 1.7 through 1.7.7 allows remote attackers to inject arbitrary web script or HTML via vectors related to the url variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2381 
Gizmo 3.1.0.79 on Linux does not verify a server's SSL certificate, which allows remote servers to obtain the credentials of arbitrary users via a spoofed certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2382 
admin.php in phpMyBlockchecker 1.0.0055 allows remote attackers to bypass authentication and gain administrative access by setting the PHPMYBCAdmin cookie to LOGGEDIN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2383 
SQL injection vulnerability in BTE_RW_webajax.php in the Related Sites plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the guid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z
CVE-2009-2384 
Buffer overflow in amp.exe in Brothersoft PEamp 1.02b allows user-assisted remote attackers to execute arbitrary code via a long string in a .m3u playlist file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-07-08T15:00:00.000Z