rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-4622 
PHP remote file inclusion vulnerability in admin/admin_news_bot.php in Drunken:Golem Gaming Portal 0.5.1 alpha 2 allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter, a different vector than CVE-2007-0572.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-18T20:00:00.000Z
CVE-2009-4623 
Multiple PHP remote file inclusion vulnerabilities in Advanced Comment System 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the ACS_path parameter to (1) index.php and (2) admin.php in advanced_comment_system/. NOTE: this might only be a vulnerability when the administrator has not followed installation instructions in install.php. NOTE: this might be the same as CVE-2020-35598.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-18T20:00:00.000Z
CVE-2009-4624 
SQL injection vulnerability in download.php in Nicecoder iDesk allows remote attackers to execute arbitrary SQL commands via the cat_id parameter, a different vector than CVE-2005-3843.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-18T20:00:00.000Z
CVE-2009-4625 
SQL injection vulnerability in the updateOnePage function in components/com_bfsurvey_pro/controller.php in BF Survey Pro Free (com_bfsurvey_profree) 1.2.4, and other versions before 1.2.6, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the table parameter in an updateOnePage action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-18T20:00:00.000Z
CVE-2009-4626 
Directory traversal vulnerability in menu.php in phpNagios 1.2.0 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the conf[lang] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-18T20:00:00.000Z
CVE-2009-4627 
Directory traversal vulnerability in sources/_template_parser.php in Moa Gallery 1.2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the p_filename parameter, a different issue than CVE-2009-4614.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-18T20:00:00.000Z
CVE-2009-4628 
SQL injection vulnerability in the TemplatePlaza.com TPDugg (com_tpdugg) component 1.1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a tags action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-18T20:00:00.000Z
CVE-2009-4629 
Mozilla Necko, as used in Thunderbird 3.0.1, SeaMonkey, and other applications, performs DNS prefetching even when the app type is APP_TYPE_MAIL or APP_TYPE_EDITOR, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests, as demonstrated by DNS requests triggered by reading text/plain e-mail messages in Thunderbird.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-29T18:00:00.000Z
CVE-2009-4630 
Mozilla Necko, as used in Firefox, SeaMonkey, and other applications, performs DNS prefetching of domain names contained in links within local HTML documents, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests.  NOTE: the vendor disputes the significance of this issue, stating "I don't think we necessarily need to worry about that case."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-29T18:00:00.000Z
CVE-2009-4631 
Off-by-one error in the VP3 decoder (vp3.c) in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted VP3 file that triggers an out-of-bounds read and possibly memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4632 
oggparsevorbis.c in FFmpeg 0.5 does not properly perform certain pointer arithmetic, which might allow remote attackers to obtain sensitive memory contents and cause a denial of service via a crafted file that triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4633 
vorbis_dec.c in FFmpeg 0.5 uses an assignment operator when a comparison operator was intended, which might allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that modifies a loop counter and triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4634 
Multiple integer underflows in FFmpeg 0.5 allow remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted file that (1) bypasses a validation check in vorbis_dec.c and triggers a wraparound of the stack pointer, or (2) access a pointer from out-of-bounds memory in mov.c, related to an elst tag that appears before a tag that creates a stream.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4635 
FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted MOV container with improperly ordered tags that cause (1) mov.c and (2) utils.c to use inconsistent codec types and identifiers, leading to processing of a video-structure pointer by the mp3 decoder, and a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4636 
FFmpeg 0.5 allows remote attackers to cause a denial of service (hang) via a crafted file that triggers an infinite loop.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4637 
FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors that trigger a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4638 
Integer overflow in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4639 
The av_rescale_rnd function in the AVI demuxer in FFmpeg 0.5 allows remote attackers to cause a denial of service (crash) via a crafted AVI file that triggers a divide-by-zero error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4640 
Array index error in vorbis_dec.c in FFmpeg 0.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted Vorbis file that triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-10T02:00:00.000Z
CVE-2009-4641 
gnome-screensaver 2.28.0 does not resume adherence to its activation settings after an inhibiting application becomes unavailable on the session bus, which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-11T21:00:00.000Z
CVE-2009-4642 
gnome-screensaver 2.26.1 relies on the gnome-session D-Bus interface to determine session idle time, even when an Xfce desktop such as Xubuntu or Mythbuntu is used, which allows physically proximate attackers to access an unattended workstation on which screen locking had been intended.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-11T21:00:00.000Z
CVE-2009-4643 
Stack-based buffer overflow in dsInstallerService.dll in the Juniper Installer Service, as used in Juniper Odyssey Access Client 4.72.11421.0 and other products, allows remote attackers to execute arbitrary code via a long string in a malformed DSSETUPSERVICE_CMD_UNINSTALL command to the NeoterisSetupService named pipe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-15T18:00:00.000Z
CVE-2009-4644 
Accellion Secure File Transfer Appliance before 8_0_105 allows remote authenticated administrators to bypass the restricted shell and execute arbitrary commands via shell metacharacters to the ping command, as demonstrated by modifying the cli program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-19T17:00:00.000Z
CVE-2009-4645 
Directory traversal vulnerability in web_client_user_guide.html in Accellion Secure File Transfer Appliance before 8_0_105 allows remote attackers to read arbitrary files via a .. (dot dot) in the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-19T17:00:00.000Z
CVE-2009-4646 
Static code injection vulnerability in the administrative web interface in Accellion Secure File Transfer Appliance allows remote authenticated administrators to inject arbitrary shell commands by appending them to a request to update the SNMP public community string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-19T17:00:00.000Z
CVE-2009-4647 
Cross-site scripting (XSS) vulnerability in Accellion Secure File Transfer Appliance before 7_0_296 allows remote attackers to inject arbitrary web script or HTML via the username parameter, which is not properly handled when the administrator views audit logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-19T17:00:00.000Z
CVE-2009-4648 
Accellion Secure File Transfer Appliance before 8_0_105 does not properly restrict access to sensitive commands and arguments that run with extra sudo privileges, which allows local administrators to gain privileges via (1) arbitrary arguments in the --file_move action in /usr/local/bin/admin.pl, or a hard link attack in (2) chmod or (3) a certain cp command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-19T17:00:00.000Z
CVE-2009-4649 
Multiple cross-site scripting (XSS) vulnerabilities in geccBBlite 0.1 allow remote attackers to inject arbitrary web script or HTML via the postatoda parameter to (1) rispondi.php and (2) scrivi.php, which is not properly handled in forum.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T20:00:00.000Z
CVE-2009-4650 
SQL injection vulnerability in the Webee Comments (com_webeecomment) component 1.1.1, 1.2, and 2.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the articleId parameter in a default action to index2.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T21:00:00.000Z
CVE-2009-4651 
Multiple cross-site scripting (XSS) vulnerabilities in the Webee Comments (com_webeecomment) component 1.1.1, 1.2, and 2.0 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) color, (2) img, or (3) url BBCode tags in unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-22T21:00:00.000Z
CVE-2009-4652 
The (1) Conn_GetCipherInfo and (2) Conn_UsesSSL functions in src/ngircd/conn.c in ngIRCd 13 and 14, when SSL/TLS support is present and standalone mode is disabled, allow remote attackers to cause a denial of service (application crash) by sending the MOTD command from another server in the same IRC network, possibly related to an array index error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T18:09:00.000Z
CVE-2009-4653 
Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to cause a denial of service (dhost.exe crash) and possibly execute arbitrary code via a long string to /dhost/modules?I:.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T18:09:00.000Z
CVE-2009-4654 
Stack-based buffer overflow in the dhost module in Novell eDirectory 8.8 SP5 for Windows allows remote authenticated users to execute arbitrary code via long sadminpwd and verifypwd parameters in a submit action to /dhost/httpstk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T18:09:00.000Z
CVE-2009-4655 
The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-02-26T18:09:00.000Z
CVE-2009-4656 
Stack-based buffer overflow in E-Soft DJ Studio Pro 4.2 including 4.2.2.7.5, and 5.x including 5.1.4.3.1, allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a playlist file (.pls) containing a long string.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4657 
The administrator package for Xerver 4.32 does not require authentication, which allows remote attackers to alter application settings by connecting to the application on port 32123, as demonstrated by setting the action option to wizardStep1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4658 
Xerver 4.32 allows remote authenticated users to cause a denial of service (daemon crash) via a non-numeric web port assignment in the management interface.  NOTE: this can be leveraged by non-authenticated attackers using CVE-2009-4657.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4659 
Unspecified vulnerability in MP3-Cutter Ease Audio Cutter 1.20 allows user-assisted remote attackers to cause a denial of service (application crash) via a long string in a WAV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4660 
Stack-based buffer overflow in the AntServer Module (AntServer.exe) in BigAnt IM Server 2.50 allows remote attackers to execute arbitrary code via a long GET request to TCP port 6660.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4661 
Multiple buffer overflows in BigAnt Server 2.50 SP6 and earlier allow user-assisted remote attackers to cause a denial of service (application crash) via a crafted ZIP file that is not properly handled when the victim uses the (1) Update or (2) Plug-In console menu item.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4662 
Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 7.0 before 7.03 HP4 and 8.0 before 8.0 SP1 allows remote attackers to inject arbitrary web script or HTML via the User.Theme.index parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4663 
Heap-based buffer overflow in the Quiksoft EasyMail Objects 6 ActiveX control allows remote attackers to execute arbitrary code via a long argument to the AddAttachment method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4664 
Firewall Builder 3.0.4, 3.0.5, and 3.0.6, when running on Linux, allows local users to gain privileges via a symlink attack on an unspecified temporary file that is created by the iptables script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-03T20:00:00.000Z
CVE-2009-4665 
Directory traversal vulnerability in CuteSoft_Client/CuteEditor/Load.ashx in CuteSoft Components Cute Editor for ASP.NET allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4666 
Multiple PHP remote file inclusion vulnerabilities in Webradev Download Protect 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[RootPath] parameter to (1) Framework/EmailTemplates.class.php, (2) Customers/PDPEmailReplaceConstants.class.php, and (3) Admin/ResellersManager.class.php in includes/DProtect/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4667 
SQL injection vulnerability in form.php in WebMember 1.0 allows remote authenticated users to execute arbitrary SQL commands via the formID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4668 
Stack-based buffer overflow in JetCast.exe 2.0.4.1109 in jetAudio 7.5.2 and 7.5.3.15 allows remote attackers to execute arbitrary code via a long ID3 tag in an MP3 file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4669 
Multiple SQL injection vulnerabilities in RoomPHPlanning 1.6 allow remote attackers to execute arbitrary SQL commands via (1) the loginus parameter to Login.php or (2) the Old Password field to changepwd.php, and allow (3) remote authenticated administrators to execute arbitrary SQL commands via the id parameter to admin/userform.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4670 
admin/delitem.php in RoomPHPlanning 1.6 does not require authentication, which allows remote attackers to (1) delete arbitrary users via the user parameter or (2) delete arbitrary rooms via the room parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4671 
Login.php in RoomPHPlanning 1.6 allows remote attackers to bypass authentication and obtain administrative access by setting the room_phplanning cookie to a value associated with the admin account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4672 
Directory traversal vulnerability in main.php in the WP-Lytebox plugin 1.3 for WordPress allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the pg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4673 
SQL injection vulnerability in profile.php in Mole Group Adult Portal Script allows remote attackers to execute arbitrary SQL commands via the user_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4674 
admin/admin.php in Mole Group Sky Hunter Airline Ticket Sale Script and Bus Ticket Script allows remote attackers to change an arbitrary password via a modified user_id field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4675 
admin/admin_info/index.php in the Mole Group Gastro Portal (Restaurant Directory) Script does not require administrative authentication, which allows remote attackers to change the admin password via an unspecified form submission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T18:00:00.000Z
CVE-2009-4676 
Stack-based buffer overflow in JetCast.exe 2.0.4.1109 in jetAudio 7.5.2 and 7.5.3.15 allows remote attackers to execute arbitrary code via a long title in a FLAC file.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T19:00:00.000Z
CVE-2009-4677 
Cross-site scripting (XSS) vulnerability in search.php in phpFK PHP Forum ohne 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the search parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-08T15:00:00.000Z
CVE-2009-4678 
Cross-site scripting (XSS) vulnerability in index.php in Winn Guestbook 2.4 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-08T15:00:00.000Z
CVE-2009-4679 
Directory traversal vulnerability in the inertialFATE iF Portfolio Nexus (com_if_nexus) component 1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-08T15:00:00.000Z
CVE-2009-4680 
SQL injection vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to execute arbitrary SQL commands via the st parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z
CVE-2009-4681 
Cross-site scripting (XSS) vulnerability in search.php in phpDirectorySource 1.x allows remote attackers to inject arbitrary web script or HTML via the st parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z
CVE-2009-4682 
Cross-site scripting (XSS) vulnerability in vote.php in Good/Bad Vote allows remote attackers to inject arbitrary web script or HTML via the id parameter in a vote action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z
CVE-2009-4683 
Directory traversal vulnerability in vote.php in Good/Bad Vote allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the id parameter in a dovote action. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z
CVE-2009-4684 
Cross-site scripting (XSS) vulnerability in index.php in EZodiak allows remote attackers to inject arbitrary web script or HTML via the sign parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z
CVE-2009-4685 
Cross-site scripting (XSS) vulnerability in celebrities.php in PHP Scripts Now Astrology allows remote attackers to inject arbitrary web script or HTML via the day parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z
CVE-2009-4686 
Cross-site scripting (XSS) vulnerability in account.php in phplemon AdQuick 2.2.1 allows remote attackers to inject arbitrary web script or HTML via the red_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z
CVE-2009-4687 
SQL injection vulnerability in silentum_guestbook.php in Silentum Guestbook 2.0.2 allows remote attackers to execute arbitrary SQL commands via the messageid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-10T22:00:00.000Z