rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-2749 
Feature Pack for Communications Enabled Applications (CEA) before 1.0.0.1 for IBM WebSphere Application Server 7.0.0.7 uses predictable session values, which allows man-in-the-middle attackers to spoof a collaboration session by guessing the value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-08T17:00:00.000Z
CVE-2009-2750 
IBM WebSphere Service Registry and Repository (WSRR) 6.3.0 before FP2 does not have the intended configuration properties, which allows remote authenticated users to obtain unspecified data access via a property query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-04T18:00:00.000Z
CVE-2009-2751 
IBM WebSphere Commerce 7.0 uses the same cryptographic key for session attributes and merchant data encryption, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2009-2752 
IBM WebSphere Commerce 7.0 does not properly encrypt data in a database, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-05T22:13:00.000Z
CVE-2009-2753 
Multiple buffer overflows in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3, allow remote attackers to execute arbitrary code via a crafted parameter size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T16:00:00.000Z
CVE-2009-2754 
Integer signedness error in the authentication functionality in librpc.dll in the Informix Storage Manager (ISM) Portmapper service (aka portmap.exe), as used in IBM Informix Dynamic Server (IDS) 10.x before 10.00.TC9 and 11.x before 11.10.TC3 and EMC Legato NetWorker, allows remote attackers to execute arbitrary code via a crafted parameter size that triggers a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T16:00:00.000Z
CVE-2009-2761 
Unquoted Windows search path vulnerability in the scheduler (sched.exe) in Avira AntiVir, AntiVir Premium, Premium Security Suite, and AntiVir Professional might allow local users to gain privileges via a malicious antivir.exe file in the "C:\Program Files\avira\" directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2009-2762 
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-13T16:00:00.000Z
CVE-2009-2764 
Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 platform allows remote attackers to cause a denial of service (application crash) via a certain DIV element in conjunction with SCRIPT elements that have empty contents and no reference to a valid external script location.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2765 
httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other versions before build 12533, allows remote attackers to execute arbitrary commands via shell metacharacters in a request to a cgi-bin/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2766 
httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not require administrative authentication for programs under cgi-bin/, which allows remote attackers to change settings via HTTP requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2767 
The init_posix_timers function in kernel/posix-timers.c in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (OOPS) or possibly gain privileges via a CLOCK_MONOTONIC_RAW clock_nanosleep call that triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2768 
The load_flat_shared_library function in fs/binfmt_flat.c in the flat subsystem in the Linux kernel before 2.6.31-rc6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by executing a shared flat binary, which triggers an access of an "uninitialized cred pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T15:00:00.000Z
CVE-2009-2769 
PHP remote file inclusion vulnerability in include/timesheet.php in Ultrize TimeSheet 1.2.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the config[include_dir] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2770 
PowerUpload 2.4 allows remote attackers to bypass authentication and gain administrative access via a MIME encoded value of admin for the myadminname cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2771 
Cross-site scripting (XSS) vulnerability in Free Arcade Script 1.3 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter to the default URI under search/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2772 
Multiple cross-site scripting (XSS) vulnerabilities in PG Roommate Finder Solution allow remote attackers to inject arbitrary web script or HTML via the part parameter to (1) quick_search.php and (2) viewprofile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2773 
PHP remote file inclusion vulnerability in home.php in PHP Paid 4 Mail Script allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2774 
SQL injection vulnerability in paidbanner.php in PHP Paid 4 Mail Script allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2775 
SQL injection vulnerability in linkout.php in PHPArcadeScript (PHP Arcade Script) 4.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2776 
SQL injection vulnerability in showresult.asp in Smart ASP Survey allows remote attackers to execute arbitrary SQL commands via the catid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2777 
SQL injection vulnerability in visitor/view.php in GarageSales Script allows remote attackers to execute arbitrary SQL commands via the key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2778 
Cross-site scripting (XSS) vulnerability in visitor/view.php in GarageSales Script allows remote attackers to inject arbitrary web script or HTML via the key parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-14T17:00:00.000Z
CVE-2009-2779 
SQL injection vulnerability in index.php in AJ Matrix DNA allows remote attackers to execute arbitrary SQL commands via the id parameter in a productdetail action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2780 
Multiple cross-site scripting (XSS) vulnerabilities in 68 Classifieds 4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter to category.php, view parameter to (2) login.php and (3) viewlisting.php, page parameter to (4) searchresults.php and (5) toplistings.php, and (6) member parameter to viewmember.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2781 
SQL injection vulnerability in forum.php in Arab Portal 2.x, when magic_quotes_gpc is disabled, allows remote authenticated users to execute arbitrary SQL commands via the qc parameter in an addcomment action, a different vector than CVE-2006-1666.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2782 
SQL injection vulnerability in the JFusion (com_jfusion) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2783 
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.3.3 allow remote attackers to inject arbitrary web script or HTML via the (1) op parameter to modules/pm/viewpmsg.php and (2) query string to modules/profile/user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2784 
Multiple directory traversal vulnerabilities in dit.cms 1.3, when register_globals is enabled, allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the path parameter to index.php in (1) install/, (2) menus/left_rightslideopen/, (3) menus/side_pullout/, (4) menus/side_slideopen/, (5) menus/simple/, (6) menus/top_dropdown/, and (7) menus/topside/; the sitemap parameter to index.php in (8) menus/left_rightslideopen/, (9) menus/side_pullout/, (10) menus/side_slideopen/, (11) menus/top_dropdown/, and (12) menus/topside/; and the (13) relPath parameter to index/index.php. NOTE: PHP remote file inclusion vulnerabilities reportedly also exist for some of these vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2785 
Multiple cross-site scripting (XSS) vulnerabilities in PHP Open Classifieds Script allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter to buy.php and the id parameter to (2) contact.php and (3) tellafriend.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2786 
SQL injection vulnerability in reputation.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB allows remote attackers to execute arbitrary SQL commands via the poster parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2787 
Directory traversal vulnerability in include/reputation/rep_profile.php in the Reputation plugin 2.2.4, 2.2.3, 2.0.4, and earlier for PunBB, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pun_user[language] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2788 
Multiple SQL injection vulnerabilities in Mobilelib GOLD 3 allow remote attackers to execute arbitrary SQL commands via the (1) adminName parameter to cp/auth.php, (2) cid parameter to artcat.php, and (3) catid parameter to show.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2789 
SQL injection vulnerability in the Permis (com_groups) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a list action to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2790 
SQL injection vulnerability in cat_products.php in SoftBiz Dating Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.  NOTE: this might overlap CVE-2006-3271.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2791 
PHP remote file inclusion vulnerability in pda_projects.php in WebDynamite ProjectButler 1.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the offset parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2792 
Directory traversal vulnerability in plugings/pagecontent.php in Really Simple CMS (RSCMS) 0.3a allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the PT parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-08-17T16:00:00.000Z
CVE-2009-2793 
The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment limits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T22:00:00.000Z
CVE-2009-2794 
The Exchange Support component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not properly implement the "Maximum inactivity time lock" functionality, which allows local users to bypass intended Microsoft Exchange restrictions by choosing a large Require Passcode time value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-2795 
Heap-based buffer overflow in the Recovery Mode component in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, allows local users to bypass the passcode requirement and access arbitrary data via vectors related to "command parsing."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-2796 
The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for iPod touch, allows physically proximate attackers to discover a password by watching a user undo deletions of characters in the password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-2797 
The WebKit component in Safari in Apple iPhone OS before 3.1, and iPhone OS before 3.1.1 for iPod touch, does not remove usernames and passwords from URLs sent in Referer headers, which allows remote attackers to obtain sensitive information by reading Referer logs on a web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-2798 
Heap-based buffer overflow in Apple QuickTime before 7.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FlashPix file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-2799 
Heap-based buffer overflow in Apple QuickTime before 7.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted H.264 movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-2800 
Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted alias file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-11T18:00:00.000Z
CVE-2009-2801 
The Application Firewall in Apple Mac OS X 10.5.8 drops unspecified firewall rules after a reboot, which might allow remote attackers to bypass intended access restrictions via packet data, related to a "timing issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-30T17:00:00.000Z
CVE-2009-2802 
MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-09T02:12:21.000Z
CVE-2009-2803 
CarbonCore in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a file with a crafted resource fork.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2804 
Integer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5.8, and Safari before 4.0.4 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ColorSync profile embedded in an image, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2805 
Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JBIG2 stream in a PDF file, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2807 
Heap-based buffer overflow in the USB backend in CUPS in Apple Mac OS X 10.5.8 allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2808 
Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS connection to retrieve Apple Help content from a web site, which allows man-in-the-middle attackers to send a crafted help:runscript link, and thereby execute arbitrary code, via a spoofed response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-10T19:00:00.000Z
CVE-2009-2809 
ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PixarFilm encoded TIFF image, related to "multiple memory corruption issues."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2810 
Launch Services in Apple Mac OS X 10.6.x before 10.6.2 recursively clears quarantine information upon opening a quarantined folder, which allows user-assisted remote attackers to execute arbitrary code via a quarantined application that does not trigger a "potentially unsafe" warning message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-10T19:00:00.000Z
CVE-2009-2811 
Incomplete blacklist vulnerability in Launch Services in Apple Mac OS X 10.5.8 allows user-assisted remote attackers to execute arbitrary code via a .fileloc file, which does not trigger a "potentially unsafe" warning message in the Quarantine feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2812 
Launch Services in Apple Mac OS X 10.5.8 does not properly recognize an unsafe Uniform Type Identifier (UTI) in an exported document type in a downloaded application, which allows remote attackers to trigger the automatic opening of a file, and execute arbitrary code, via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2813 
Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2814 
Cross-site scripting (XSS) vulnerability in the Wiki Server in Apple Mac OS X 10.5.8 allows remote attackers to inject arbitrary web script or HTML via a search request containing data that does not use UTF-8 encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-2815 
The Telephony component in Apple iPhone OS before 3.1 does not properly handle SMS arrival notifications, which allows remote attackers to cause a denial of service (NULL pointer dereference and service interruption) via a crafted SMS message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-10T21:00:00.000Z
CVE-2009-2816 
The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-13T15:00:00.000Z
CVE-2009-2817 
Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .pls file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-24T18:00:00.000Z
CVE-2009-2818 
Adaptive Firewall in Apple Mac OS X before 10.6.2 does not properly handle invalid usernames in SSH login attempts, which makes it easier for remote attackers to obtain login access via a brute-force attack (aka dictionary attack).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-10T19:00:00.000Z
CVE-2009-2819 
AFP Client in Apple Mac OS X 10.5.8 allows remote AFP servers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-10T19:00:00.000Z
CVE-2009-2820 
The web interface in CUPS before 1.4.2, as used on Apple Mac OS X before 10.6.2 and other platforms, does not properly handle (1) HTTP headers and (2) HTML templates, which allows remote attackers to conduct cross-site scripting (XSS) attacks and HTTP response splitting attacks via vectors related to (a) the product's web interface, (b) the configuration of the print system, and (c) the titles of printed jobs, as demonstrated by an XSS attack that uses the kerberos parameter to the admin program, and leverages attribute injection and HTTP Parameter Pollution (HPP) issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-11-10T19:00:00.000Z