rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-2085 
The default configuration of ASP.NET in Microsoft .NET before 1.1 has a value of FALSE for the EnableViewStateMac property, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the __VIEWSTATE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T18:32:00.000Z
CVE-2010-2086 
Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T18:32:00.000Z
CVE-2010-2087 
Oracle Mojarra 1.2_14 and 2.0.2, as used in IBM WebSphere Application Server, Caucho Resin, and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T18:32:00.000Z
CVE-2010-2088 
ASP.NET in Microsoft .NET 3.5 does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks against the form control via the __VIEWSTATE parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T18:32:00.000Z
CVE-2010-2089 
The audioop module in Python 2.7 and 3.2 does not verify the relationships between size arguments and byte string lengths, which allows context-dependent attackers to cause a denial of service (memory corruption and application crash) via crafted arguments, as demonstrated by a call to audioop.reverse with a one-byte string, a different vulnerability than CVE-2010-1634.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T19:00:00.000Z
CVE-2010-2090 
The npb_protocol_error function in sna V5router64 in IBM Communications Server for Windows 6.1.3 and Communications Server for AIX (aka CSAIX or CS/AIX) in sna.rte before 6.3.1.2 allows remote attackers to cause a denial of service (daemon crash) via APPC data containing a GDSID variable with a GDS length that is too small.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T19:00:00.000Z
CVE-2010-2091 
Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T19:00:00.000Z
CVE-2010-2092 
SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rra_id parameter in a GET request in conjunction with a valid rra_id value in a POST request or a cookie, which causes the POST or cookie value to bypass the validation routine, but inserts the $_GET value into the resulting query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2093 
Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3.2 allows context-dependent attackers to cause a denial of service (crash) via a stream context structure that is freed before destruction occurs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2094 
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2095 
SQL injection vulnerability in index.php in CMSQlite 1.2 and earlier allows remote attackers to execute arbitrary SQL commands via the c parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2096 
Directory traversal vulnerability in index.php in CMSQlite 1.2 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the mod parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2097 
The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2098 
Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2099 
bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2100 
The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2101 
The (1) strip_tags, (2) setcookie, (3) strtok, (4) wordwrap, (5) str_word_count, and (6) str_pad functions in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) by causing a userspace interruption of an internal function, related to the call time pass by reference feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2102 
Buffer overflow in Webby Webserver 1.01 allows remote attackers to execute arbitrary code via a long HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2103 
Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2104 
Directory traversal vulnerability in Orbit Downloader 3.0.0.4 and 3.0.0.5 allows user-assisted remote attackers to write arbitrary files via a metalink file containing directory traversal sequences in the name attribute of a file element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-27T22:00:00.000Z
CVE-2010-2105 
Google Chrome before 5.0.375.55 does not properly follow the Safe Browsing specification's requirements for canonicalization of URLs, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T18:00:00.000Z
CVE-2010-2106 
Unspecified vulnerability in Google Chrome before 5.0.375.55 might allow remote attackers to spoof the URL bar via vectors involving unload event handlers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T18:00:00.000Z
CVE-2010-2107 
Unspecified vulnerability in Google Chrome before 5.0.375.55 allows attackers to cause a denial of service (memory error) or possibly have unspecified other impact via vectors related to the Safe Browsing functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T18:00:00.000Z
CVE-2010-2108 
Unspecified vulnerability in Google Chrome before 5.0.375.55 allows remote attackers to bypass the whitelist-mode plugin blocker via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T18:00:00.000Z
CVE-2010-2109 
Unspecified vulnerability in Google Chrome before 5.0.375.55 allows user-assisted remote attackers to cause a denial of service (memory error) or possibly have unspecified other impact via vectors related to the "drag + drop" functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T18:00:00.000Z
CVE-2010-2110 
Google Chrome before 5.0.375.55 does not properly execute JavaScript code in the extension context, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T18:00:00.000Z
CVE-2010-2111 
Cross-site request forgery (CSRF) vulnerability in user/user-set.do in Pacific Timesheet 6.74 build 363 allows remote attackers to hijack the authentication of administrators for requests that create a new administrator via a new_admin action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T20:00:00.000Z
CVE-2010-2112 
Directory traversal vulnerability in the FTP service in FileCOPA before 5.03 allows remote attackers to read or overwrite arbitrary files via unknown vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T20:00:00.000Z
CVE-2010-2113 
Multiple cross-site request forgery (CSRF) vulnerabilities in The Uniform Server 5.6.5 allow remote attackers to hijack the authentication of administrators for requests that change passwords via (1) apsetup.php, (2) psetup.php, (3) sslpsetup.php, or (4) mqsetup.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T20:00:00.000Z
CVE-2010-2114 
Cross-site request forgery (CSRF) vulnerability in pbx/gate in Brekeke PBX 2.4.4.8 allows remote attackers to hijack the authentication of users for requests that change passwords via the pbxadmin.web.PbxUserEdit bean.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T20:00:00.000Z
CVE-2010-2115 
SolarWinds TFTP Server 10.4.0.10 allows remote attackers to cause a denial of service (no new connections) via a crafted read request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T20:00:00.000Z
CVE-2010-2116 
The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-05-28T20:00:00.000Z
CVE-2010-2117 
Mozilla Firefox 3.0.19, 3.5.x, and 3.6.x allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid (1) news:// or (2) nntp:// URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T20:00:00.000Z
CVE-2010-2118 
Microsoft Internet Explorer 6.0.2900.2180 and 8.0.7600.16385 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T20:00:00.000Z
CVE-2010-2119 
Microsoft Internet Explorer 6.0.2900.2180 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid nntp:// URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T20:00:00.000Z
CVE-2010-2120 
Google Chrome 1.0.154.48 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid news:// URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T20:00:00.000Z
CVE-2010-2121 
Opera 9.52 allows remote attackers to cause a denial of service (resource consumption) via JavaScript code containing an infinite loop that creates IFRAME elements for invalid (1) news:// or (2) nntp:// URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T20:00:00.000Z
CVE-2010-2122 
Directory traversal vulnerability in the SimpleDownload (com_simpledownload) component before 0.9.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2123 
Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) address, (3) city, (4) provstate (aka state), (5) phone, or (6) taxid parameter in a stormorganization action to index.php; the (7) name parameter in a stormperson action to index.php; the (8) stepno (aka Step no.) or (9) title parameter in a stormtask action to index.php; the (10) title (aka Project) parameter in a stormticket action to index.php; or (11) unspecified parameters in a stormproject action to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2124 
SQL injection vulnerability in firma.php in Bartels Schone ConPresso 4.0.7 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2125 
Multiple cross-site scripting (XSS) vulnerabilities in the Rotor Banner module 5.x before 5.x-1.8 and 6.x before 6.x-2.5 for Drupal allow remote authenticated users, with "create rotor item" or "edit any rotor item" privileges, to inject arbitrary web script or HTML via the (1) srs, (2) title, or (3) alt image attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2126 
Multiple PHP remote file inclusion vulnerabilities in Snipe Gallery 3.1.5 allow remote attackers to execute arbitrary PHP code via a URL in the cfg_admin_path parameter to (1) index.php, (2) view.php, (3) image.php, (4) search.php, (5) admin/index.php, (6) admin/gallery/index.php, (7) admin/gallery/view.php, (8) admin/gallery/gallery.php, (9) admin/gallery/image.php, and (10) admin/gallery/crop.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2127 
PHP remote file inclusion vulnerability in gallery.php in JV2 Folder Gallery 3.1 allows remote attackers to execute arbitrary PHP code via a URL in the lang_file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2128 
Directory traversal vulnerability in the JE Quotation Form (com_jequoteform) component 1.0b1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the view parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2129 
Directory traversal vulnerability in the JE Ajax Event Calendar (com_jeajaxeventcalendar) component 1.0.1 and 1.0.3 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the view parameter to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-01T21:00:00.000Z
CVE-2010-2130 
Cross-site scripting (XSS) vulnerability in wflogin.jsp in Aris Global ARISg 5.0 allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2131 
SQL injection vulnerability in the Calendar Base (cal) extension before 1.3.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via iCalendar data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2132 
Multiple PHP remote file inclusion vulnerabilities in Open Education System (OES) 0.1 beta allow remote attackers to execute arbitrary PHP code via a URL in the CONF_INCLUDE_PATH parameter to (1) forum/admin.php and (2) plotgraph/index.php in admin/modules/modules/, and (3) admin_user/mod_admuser.php and (4) ogroup/mod_group.php in admin/modules/user_account/, different vectors than CVE-2007-1446.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2133 
SQL injection vulnerability in contact.php in My Little Forum allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-2942.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2134 
Multiple SQL injection vulnerabilities in login.php in Project Man 1.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2135 
Multiple SQL injection vulnerabilities in login.php in HazelPress Lite 0.0.4 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) Username and (2) password fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2136 
Directory traversal vulnerability in admin/index.php in Article Friendly, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2137 
PHP remote file inclusion vulnerability in _center.php in ProMan 0.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2138 
Multiple directory traversal vulnerabilities in ProMan 0.1.1 and earlier allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SESSION[userLang] parameter to (1) elisttasks.php, (2) managepmanagers.php, (3) manageusers.php, (4) helpfunc.php, (5) managegroups.php, (6) manageprocess.php, and (7) manageusersgroups.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T18:14:00.000Z
CVE-2010-2139 
SQL injection vulnerability in pages.php in Multishop CMS allows remote attackers to execute arbitrary SQL commands via the id parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T19:00:00.000Z
CVE-2010-2140 
SQL injection vulnerability in itemdetail.php in Multishop CMS allows remote attackers to execute arbitrary SQL commands via the itemid parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T19:00:00.000Z
CVE-2010-2141 
SQL injection vulnerability in index.php in NITRO Web Gallery allows remote attackers to execute arbitrary SQL commands via the PictureId parameter in an open action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T19:00:00.000Z
CVE-2010-2142 
SQL injection vulnerability in default.asp in Cyberhost allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-02T19:00:00.000Z
CVE-2010-2143 
Directory traversal vulnerability in index.php in Symphony CMS 2.0.7 allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the mode parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-03T14:00:00.000Z
CVE-2010-2144 
Cross-site scripting (XSS) vulnerability in signinform.php in Zeeways eBay Clone Auction Script allows remote attackers to inject arbitrary web script or HTML via the msg parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-03T14:00:00.000Z
CVE-2010-2145 
Multiple PHP remote file inclusion vulnerabilities in ClearSite Beta 4.50, and possibly other versions, allow remote attackers to execute arbitrary PHP code via a URL in the cs_base_path parameter to (1) docs.php and (2) include/admin/device_admin.php.  NOTE: the header.php vector is already covered by CVE-2009-3306.  NOTE: this issue may be due to a variable extraction error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-03T14:00:00.000Z
CVE-2010-2146 
PHP remote file inclusion vulnerability in banned.php in Visitor Logger allows remote attackers to execute arbitrary PHP code via a URL in the VL_include_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-03T14:00:00.000Z
CVE-2010-2147 
Cross-site scripting (XSS) vulnerability in the My Car (com_mycar) component 1.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the modveh parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-06-03T14:00:00.000Z