rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-5093 
Directory traversal vulnerability in gastbuch.php in Gästebuch (Gastebuch) 1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the start parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5094 
SQL injection vulnerability in info.php in CMS Faethon 2.2.0 Ultimate allows remote attackers to execute arbitrary SQL commands via the item parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5095 
PHP remote file inclusion vulnerability in index_inc.php in ea gBook 0.1 and 0.1.4 allows remote attackers to execute arbitrary PHP code via a URL in the inc_ordner parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-09T23:00:00.000Z
CVE-2009-5096 
Cross-site scripting (XSS) vulnerability in the Flag Content module 5.x-2.x before 5.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via the Reason parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-13T19:00:00.000Z
CVE-2009-5097 
Palm Pre WebOS 1.1 and earlier processes JavaScript in email messages, which allows remote attackers to execute arbitrary JavaScript, as demonstrated by reading PalmDatabase.db3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-13T19:00:00.000Z
CVE-2009-5098 
The LunaSysMgr process in Palm Pre WebOS 1.1 and earlier, when not viewing web pages in landscape mode, allows remote attackers to cause a denial of service (crash) via a web page containing a long string following a refresh tag, which triggers a floating point exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-13T19:00:00.000Z
CVE-2009-5099 
Cross-site scripting (XSS) vulnerability in ViewAction in Pentaho BI Server 1.7.0.1062 and earlier allows remote attackers to inject arbitrary web script or HTML via the outputType parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-13T19:00:00.000Z
CVE-2009-5100 
Pentaho BI Server 1.7.0.1062 and earlier does not set the autocomplete tag to off on web pages using a password field, which might allow physically proximate attackers to obtain the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-13T19:00:00.000Z
CVE-2009-5101 
Pentaho BI Server 1.7.0.1062 and earlier includes the session ID (JSESSIONID) in the URL, which allows attackers to obtain it from session history, referer headers, or sniffing of web traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-13T19:00:00.000Z
CVE-2009-5102 
SQL injection vulnerability in default.asp in ATCOM Netvolution 1.0 ASP allows remote attackers to execute arbitrary SQL commands via the bpe_nid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-21T10:00:00.000Z
CVE-2009-5103 
Cross-site scripting (XSS) vulnerability in ATCOM Netvolution 1.0 ASP allows remote attackers to inject arbitrary web script or HTML via the email variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-21T10:00:00.000Z
CVE-2009-5109 
Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long entry in a .pls file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-25T01:00:00.000Z
CVE-2009-5110 
dhttpd allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T18:00:00.000Z
CVE-2009-5111 
GoAhead WebServer allows remote attackers to cause a denial of service (daemon outage) via partial HTTP requests, as demonstrated by Slowloris.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T18:00:00.000Z
CVE-2009-5112 
wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to obtain the installation path via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-19T18:00:00.000Z
CVE-2009-5113 
Cross-site scripting (XSS) vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to inject arbitrary web script or HTML via the DOC parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-19T18:00:00.000Z
CVE-2009-5114 
Directory traversal vulnerability in wgarcmin.cgi in WebGlimpse 2.18.7 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the DOC parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-19T18:00:00.000Z
CVE-2009-5115 
McAfee Common Management Agent (CMA) 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2009-5116 
McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2009-5117 
The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2009-5118 
Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows local users to gain privileges via a Trojan horse DLL in an unspecified directory, as demonstrated by scanning a document located on a remote share.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2009-5119 
The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 enables weak SSL ciphers in conf/server.xml, which makes it easier for remote attackers to obtain sensitive information by sniffing the network and then conducting a brute-force attack against encrypted session data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-23T10:00:00.000Z
CVE-2009-5120 
The default configuration of Apache Tomcat in Websense Manager in Websense Web Security 7.0 and Web Filter 7.0 allows connections to TCP port 1812 from arbitrary source IP addresses, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 text to the 404 error page of a Project Woodstock service on this port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-23T10:00:00.000Z
CVE-2009-5121 
Websense Email Security 7.1 before Hotfix 4 allows remote attackers to bypass the sender-based blacklist by using the 8BITMIME EHLO keyword in the SMTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-23T10:00:00.000Z
CVE-2009-5122 
The Personal Email Manager component in Websense Email Security before 7.2 allows remote attackers to obtain potentially sensitive information from the JBoss status page via an unspecified query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-23T10:00:00.000Z
CVE-2009-5123 
The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (memory consumption) via a crafted compressed file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2009-5124 
The Antivirus component in Comodo Internet Security before 3.11.108364.552 allows remote attackers to cause a denial of service (application crash) via a crafted packed file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2009-5125 
Comodo Internet Security before 3.9.95478.509 allows remote attackers to bypass malware detection in an RAR archive via an unspecified manipulation of the archive file format.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2009-5126 
The Antivirus component in Comodo Internet Security before 3.8.65951.477 allows remote attackers to cause a denial of service (application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2009-5127 
The Antivirus component in Comodo Internet Security before 3.8.64739.471 allows remote attackers to cause a denial of service (application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2009-5128 
The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (memory consumption and process crash) via a large file that is not properly handled during buffering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T19:00:00.000Z
CVE-2009-5129 
The Websense V10000 appliance before 1.0.1 allows remote attackers to cause a denial of service (intermittent LDAP authentication outage) via a login attempt with an incorrect password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T19:00:00.000Z
CVE-2009-5130 
The Rules Service in Websense Email Security before 7.1 allows remote attackers to cause a denial of service (service crash) via an attachment with a crafted size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T19:00:00.000Z
CVE-2009-5131 
The Receive Service in Websense Email Security before 7.1 does not recognize domain extensions in the blacklist, which allows remote attackers to bypass intended access restrictions and send e-mail messages via an SMTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T19:00:00.000Z
CVE-2009-5132 
The Filtering Service in Websense Web Security and Web Filter before 6.3.1 Hotfix 106 and 7.x before 7.1 allow remote attackers to cause a denial of service (filtering outage) via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T19:00:00.000Z
CVE-2009-5134 
Buffer overflow in the "create torrent dialog" functionality in uTorrent 1.8.3 build 15772, and possibly other versions before 1.8.3 (Build 16010), allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a text file containing a large string.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-18T23:00:00.000Z
CVE-2009-5135 
The Java XML parser in Echo before 2.1.1 and 3.x before 3.0.b6 allows remote attackers to read arbitrary files via a request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T10:00:00.000Z
CVE-2009-5136 
The policy definition evaluator in Condor before 7.4.2 does not properly handle attributes in a WANT_SUSPEND policy that evaluate to an UNDEFINED state, which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-11T22:00:00.000Z
CVE-2009-5137 
Stack-based buffer overflow in Mini-stream CastRipper 2.50.70 allows remote attackers to execute arbitrary code via a long URL in the [playlist] section in a .pls file, a different vector than CVE-2009-1667.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-02T22:00:00.000Z
CVE-2009-5138 
GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-06T18:00:00.000Z
CVE-2009-5139 
The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T13:29:00.000Z
CVE-2009-5140 
The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-12T13:28:56.000Z
CVE-2009-5141 
Format string vulnerability in War FTP Daemon (warftpd) 1.82 RC 12 allows remote authenticated users to cause a denial of service (crash) via format string specifiers in a LIST command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-01T00:00:00.000Z
CVE-2009-5142 
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb 1.09 and earlier, as used in Mimbo Pro 2.3.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the src parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T23:00:00.000Z
CVE-2009-5143 
GE Healthcare Discovery 530C has a password of #bigguy1 for the (1) acqservice user and (2) wsservice user of the Xeleris System, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2009-5144 
mod-gnutls does not validate client certificates when "GnuTLSClientVerify require" is set in a directory context, which allows remote attackers to spoof clients via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-03T00:00:00.000Z
CVE-2009-5145 
Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T17:00:00.000Z
CVE-2009-5147 
DL::dlopen in Ruby 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8 opens libraries with tainted names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-29T14:00:00.000Z
CVE-2009-5149 
Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-11-21T11:00:00.000Z
CVE-2009-5150 
Absolute Computrace Agent V80.845 and V80.866 does not have a digital signature for the configuration block, which allows attackers to set up communication with a web site other than the intended search.namequery.com site by modifying data within a disk's inter-partition space. This allows a privileged local user to execute arbitrary code even after that user loses access and all disk partitions are reformatted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T19:00:00.000Z
CVE-2009-5151 
The stub component of Absolute Computrace Agent V70.785 executes code from a disk's inter-partition space without requiring a digital signature for that code, which allows attackers to execute code on the BIOS. This allows a privileged local user to achieve persistent control of BIOS behavior, independent of later disk changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T19:00:00.000Z
CVE-2009-5152 
Absolute Computrace Agent, as distributed on certain Dell Inspiron systems through 2009, has a race condition with the Dell Client Configuration Utility (DCCU), which allows privileged local users to change Computrace Agent's activation/deactivation status to the factory default via a crafted TaskResult.xml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-11T19:00:00.000Z
CVE-2009-5153 
In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthenticated attackers to execute code, because a length field was incorrectly trusted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-11-21T15:00:00.000Z
CVE-2009-5154 
An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. There is a default password of meinsm for the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-09T22:00:00.000Z
CVE-2009-5155 
In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-02-26T02:00:00.000Z
CVE-2009-5156 
An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:46:14.000Z
CVE-2009-5157 
On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:46:23.000Z
CVE-2009-5158 
The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-08-22T12:39:41.000Z
CVE-2009-5159 
Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-03-13T14:20:59.000Z
CVE-2010-0001 
Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-29T18:00:00.000Z
CVE-2010-0002 
The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-14T18:00:00.000Z
CVE-2010-0003 
The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-26T18:00:00.000Z
CVE-2010-0004 
ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-29T18:00:00.000Z
CVE-2010-0005 
query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-29T18:00:00.000Z
CVE-2010-0006 
The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.32.4, when network namespaces are enabled, allows remote attackers to cause a denial of service (NULL pointer dereference) via an invalid IPv6 jumbogram, a related issue to CVE-2007-4567.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-26T18:00:00.000Z
CVE-2010-0007 
net/bridge/netfilter/ebtables.c in the ebtables module in the netfilter framework in the Linux kernel before 2.6.33-rc4 does not require the CAP_NET_ADMIN capability for setting or modifying rules, which allows local users to bypass intended access restrictions and configure arbitrary network-traffic filtering via a modified ebtables application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-19T16:00:00.000Z
CVE-2010-0008 
The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-19T19:00:00.000Z
CVE-2010-0009 
Apache CouchDB 0.8.0 through 0.10.1 allows remote attackers to obtain sensitive information by measuring the completion time of operations that verify (1) hashes or (2) passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-05T16:00:00.000Z
CVE-2010-0010 
Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-02T16:25:00.000Z
CVE-2010-0011 
The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T19:00:00.000Z