rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-0690 
SQL injection vulnerability in index.php in CommodityRentals Video Games Rentals allows remote attackers to execute arbitrary SQL commands via the pfid parameter in a catalog action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T18:00:00.000Z
CVE-2010-0691 
SQL injection vulnerability in druckansicht.php in JTL-Shop 2 allows remote attackers to execute arbitrary SQL commands via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T18:00:00.000Z
CVE-2010-0692 
SQL injection vulnerability in the IP-Tech JQuarks (com_jquarks) Component 0.2.3, and possibly earlier, for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T18:00:00.000Z
CVE-2010-0693 
SQL injection vulnerability in products.php in CommodityRentals Trade Manager Script allows remote attackers to execute arbitrary SQL commands via the cid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T18:00:00.000Z
CVE-2010-0694 
SQL injection vulnerability in the PerchaGallery (com_perchagallery) component before 1.5b for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in an editunidad action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T18:00:00.000Z
CVE-2010-0695 
Cross-site scripting (XSS) vulnerability in pages/index.php in BASIC-CMS allows remote attackers to inject arbitrary web script or HTML via the nav_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T18:00:00.000Z
CVE-2010-0696 
Directory traversal vulnerability in includes/download.php in the JoomlaWorks AllVideos (Jw_allVideos) plugin 3.0 through 3.2 for Joomla! allows remote attackers to read arbitrary files via a ./../.../ (modified dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T18:00:00.000Z
CVE-2010-0697 
Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users, with create content and upload file permissions, to inject arbitrary web script or HTML via the file name of an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0698 
SQL injection vulnerability in backoffice/login.asp in Dynamicsoft WSC CMS 2.2 allows remote attackers to execute arbitrary SQL commands via the Password parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0699 
Cross-site scripting (XSS) vulnerability in index.php in VideoSearchScript Pro 3.5 allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0700 
Cross-site scripting (XSS) vulnerability in index.php in WampServer 2.0i allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0701 
SQL injection vulnerability in ForceChangePassword.jsp in Newgen Software OmniDocs allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0702 
SQL injection vulnerability in cisco/services/PhonecDirectory.php in Fonality Trixbox 2.2.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0703 
Cross-site scripting (XSS) vulnerability in wa/auth in PortWise SSL VPN 4.6 allows remote attackers to inject arbitrary web script or HTML via the reloadFrame parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-23T20:00:00.000Z
CVE-2010-0704 
Cross-site scripting (XSS) vulnerability in the Portlet Palette in IBM WebSphere Portal 6.0.1.5 wp6015_008_01 allows remote attackers to inject arbitrary web script or HTML via the search field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T00:00:00.000Z
CVE-2010-0705 
Aavmker4.sys in avast! 4.8 through 4.8.1368.0 and 5.0 before 5.0.418.0 running on Windows 2000 and XP does not properly validate input to IOCTL 0xb2d60030, which allows local users to cause a denial of service (system crash) or execute arbitrary code to gain privileges via IOCTL requests using crafted kernel addresses that trigger memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T18:03:00.000Z
CVE-2010-0706 
Cross-site scripting (XSS) vulnerability in the login/prompt component in Subex Nikira Fraud Management System allows remote attackers to inject arbitrary web script or HTML via the message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T18:03:00.000Z
CVE-2010-0707 
Cross-site request forgery (CSRF) vulnerability in add_user.php in Employee Timeclock Software 0.99 allows remote attackers to hijack the authentication of an administrator for requests that create new administrative users.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T18:03:00.000Z
CVE-2010-0708 
Multiple unspecified vulnerabilities in (1) ns-slapd and (2) slapd.exe in Sun Directory Server Enterprise Edition 7.0, Sun Java System Directory Server 5.2, and Sun Java System Directory Server Enterprise Edition 6.0 through 6.3.1 allow remote attackers to cause a denial of service (daemon crash) via a crafted LDAP search request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T19:00:00.000Z
CVE-2010-0709 
Multiple cross-site request forgery (CSRF) vulnerabilities in Limny 2.0 allow remote attackers to (1) hijack the authentication of users or administrators for requests that change the email address or password via the user action to index.php, and (2) hijack the authentication of the administrator for requests that create a new user via the admin/modules/user/new action to limny/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T20:00:00.000Z
CVE-2010-0710 
SQL injection vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to execute arbitrary SQL commands via the newsid parameter when the sec parameter is 26.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T20:00:00.000Z
CVE-2010-0711 
Cross-site request forgery (CSRF) vulnerability in default.asp in ASPCode CMS 1.5.8, 2.0.0 Build 103, and possibly other versions, allows remote attackers to hijack the authentication of an administrator for requests that (1) delete users via the delete action in the ma2 parameter or (2) create administrators via the update action in the ma2 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-25T20:00:00.000Z
CVE-2010-0712 
Multiple SQL injection vulnerabilities in zport/dmd/Events/getJSONEventsInfo in Zenoss 2.3.3, and other versions before 2.5, allow remote authenticated users to execute arbitrary SQL commands via the (1) severity, (2) state, (3) filter, (4) offset, and (5) count parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T17:03:00.000Z
CVE-2010-0713 
Multiple cross-site request forgery (CSRF) vulnerabilities in Zenoss 2.3.3, and other versions before 2.5, allow remote attackers to hijack the authentication of an administrator for (1) requests that reset user passwords via zport/dmd/ZenUsers/admin, and (2) requests that change user commands, which allows for remote execution of system commands via zport/dmd/userCommands/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T17:03:00.000Z
CVE-2010-0714 
Cross-site scripting (XSS) vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to inject arbitrary web script or HTML via the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0715 
Open redirect vulnerability in login.jsp in IBM WebSphere Portal, IBM Lotus Web Content Management (WCM), and IBM Lotus Workplace Web Content Management 5.1.0.0 through 5.1.0.5, 6.0.0.0 through 6.0.0.4, 6.0.1.0 through 6.0.1.7, 6.1.0.0 through 6.1.0.3, and 6.1.5.0; and IBM Lotus Quickr services 8.0, 8.0.0.2, 8.1, 8.1.1, and 8.1.1.1 for WebSphere Portal; allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0716 
_layouts/Upload.aspx in the Documents module in Microsoft SharePoint before 2010 uses URLs with the same hostname and port number for a web site's primary files and individual users' uploaded files (aka attachments), which allows remote authenticated users to leverage same-origin relationships and conduct cross-site scripting (XSS) attacks by uploading TXT files, a related issue to CVE-2008-5026. NOTE: the vendor disputes the significance of this issue, because cross-domain isolation can be implemented when needed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0717 
The default configuration of cfg.packagepages_actions_excluded in MoinMoin before 1.8.7 does not prevent unsafe package actions, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0718 
Buffer overflow in Microsoft Windows Media Player 9 and 11.0.5721.5145 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted .mpg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0719 
An unspecified API in Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7 does not validate arguments, which allows local users to cause a denial of service (system crash) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T19:00:00.000Z
CVE-2010-0720 
SQL injection vulnerability in news.php in Erotik Auktionshaus allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T20:00:00.000Z
CVE-2010-0721 
SQL injection vulnerability in news.php in Auktionshaus Gelb 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T20:00:00.000Z
CVE-2010-0722 
SQL injection vulnerability in news.php in Php Auktion Pro allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T20:00:00.000Z
CVE-2010-0723 
SQL injection vulnerability in news.php in Ero Auktion 2.0 and 2010 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T20:00:00.000Z
CVE-2010-0724 
SQL injection vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T20:00:00.000Z
CVE-2010-0725 
Cross-site scripting (XSS) vulnerability in showimg.php in Arab Cart 1.0.2.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T20:00:00.000Z
CVE-2010-0726 
Cross-site scripting (XSS) vulnerability in the tb-send.rb (TrackBack transmission) plugin in tDiary 2.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unknown vectors, possibly related to the (1) plugin_tb_url and (2) plugin_tb_excerpt parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-02T19:00:00.000Z
CVE-2010-0727 
The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-16T19:00:00.000Z
CVE-2010-0728 
smbd in Samba 3.3.11, 3.4.6, and 3.5.0, when libcap support is enabled, runs with the CAP_DAC_OVERRIDE capability, which allows remote authenticated users to bypass intended file permissions via standard filesystem operations with any client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-09T19:00:00.000Z
CVE-2010-0729 
A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process, and consequently gain privileges, via vectors related to a missing ptrace_check_attach call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-16T19:00:00.000Z
CVE-2010-0730 
The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-11T23:00:00.000Z
CVE-2010-0731 
The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-26T18:00:00.000Z
CVE-2010-0732 
gdk/gdkwindow.c in GTK+ before 2.18.5, as used in gnome-screensaver before 2.28.1, performs implicit paints on windows of type GDK_WINDOW_FOREIGN, which triggers an X error in certain circumstances and consequently allows physically proximate attackers to bypass screen locking and access an unattended workstation by pressing the Enter key many times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-19T19:00:00.000Z
CVE-2010-0733 
Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-19T19:00:00.000Z
CVE-2010-0734 
content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-19T19:00:00.000Z
CVE-2010-0736 
Cross-site scripting (XSS) vulnerability in the view_queryform function in lib/viewvc.py in ViewVC before 1.0.10, and 1.1.x before 1.1.4, allows remote attackers to inject arbitrary web script or HTML via "user-provided input."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-19T19:00:00.000Z
CVE-2010-0737 
A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to perform management tasks and configuration changes with the privileges of the administrator user.
Problem types: description: Other
Affected products: vendor: Red Hat
product: JBoss
Published: 2019-10-30T22:11:50.000Z
CVE-2010-0738 
The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-28T22:00:00.000Z
CVE-2010-0739 
Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-16T18:00:00.000Z
CVE-2010-0740 
The ssl3_get_record function in ssl/s3_pkt.c in OpenSSL 0.9.8f through 0.9.8m allows remote attackers to cause a denial of service (crash) via a malformed record in a TLS connection that triggers a NULL pointer dereference, related to the minor version number.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-26T18:00:00.000Z
CVE-2010-0741 
The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated qemu-kvm process exit) by sending a large amount of network traffic to a TCP port on the guest OS, related to a virtio-net whitelist that includes an improper implementation of TCP Segment Offloading (TSO).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-12T18:00:00.000Z
CVE-2010-0742 
The Cryptographic Message Syntax (CMS) implementation in crypto/cms/cms_asn1.c in OpenSSL before 0.9.8o and 1.x before 1.0.0a does not properly handle structures that contain OriginatorInfo, which allows context-dependent attackers to modify invalid memory locations or conduct double-free attacks, and possibly execute arbitrary code, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-03T14:00:00.000Z
CVE-2010-0743 
Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-08T17:00:00.000Z
CVE-2010-0744 
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-20T15:00:00.000Z
CVE-2010-0745 
Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-20T17:00:00.000Z
CVE-2010-0746 
Directory traversal vulnerability in DeviceKit-disks in DeviceKit, as used in Fedora 11 and 12 and possibly other operating systems, allows local users to gain privileges via .. (dot dot) sequences in the label for a pluggable storage device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-13T21:00:00.000Z
CVE-2010-0747 
drbd8 allows local users to bypass intended restrictions for certain actions via netlink packets, similar to CVE-2009-3725.
Problem types: description: Other
Affected products: vendor: drbd8
product: drbd8
Published: 2019-10-30T22:27:45.000Z
CVE-2010-0748 
Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.
Problem types: description: Buffer Overflow
Affected products: vendor: transmission
product: transmission
Published: 2019-10-30T22:34:40.000Z
CVE-2010-0749 
Transmission before 1.92 allows attackers to prevent download of a file by corrupted data during the endgame.
Problem types: description: Denial of Service - Malformed Input
Affected products: vendor: transmission
product: transmission
Published: 2019-10-30T22:45:13.000Z
CVE-2010-0750 
pkexec.c in pkexec in libpolkit in PolicyKit 0.96 allows local users to determine the existence of arbitrary files via the argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T16:00:00.000Z
CVE-2010-0751 
The ip_evictor function in ip_fragment.c in libnids before 1.24, as used in dsniff and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via crafted fragmented packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-06T16:00:00.000Z
CVE-2010-0752 
The week_post_page function in the Weekly Archive by Node Type module 6.x before 6.x-2.7 for Drupal does not properly implement node access restrictions when constructing SQL queries, which allows remote attackers to read restricted node listings via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-27T00:00:00.000Z