rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-3183 
Heap-based buffer overflow in w in Sun Solaris 8 through 10, and OpenSolaris before snv_124, allows local users to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-14T16:00:00.000Z
CVE-2009-3184 
Multiple SQL injection vulnerabilities in index.php in Pirates of The Caribbean in the E-Gold Game Series allow remote attackers to execute arbitrary SQL commands via the (1) x and (2) y parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3185 
SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 for Discuz! allows remote authenticated users to execute arbitrary SQL commands via the fmid parameter in a view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3186 
Multiple cross-site scripting (XSS) vulnerabilities in VideoGirls BiZ allow remote attackers to inject arbitrary web script or HTML via the (1) t parameter to forum.php, (2) profile_name parameter to profile.php, and (3) p parameter to view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3187 
Cross-site scripting (XSS) vulnerability in gamelist.php in Stand Alone Arcade 1.1 allows remote attackers to inject arbitrary web script or HTML via the cat parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3188 
PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 allows remote attackers to execute arbitrary PHP code via a URL in the file_save parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3189 
Cross-site scripting (XSS) vulnerability in search.php in DigiOz Guestbook 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the search_term parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3190 
Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to list.php and (2) cat parameter to rss.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3191 
Multiple cross-site scripting (XSS) vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to inject arbitrary web script or HTML via the cat parameter to (1) rss.php and (2) opml.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3192 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in LinkorCMS 1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the searchstr parameter in a search action; or the (2) nikname, (3) realname, (4) homepage, or (5) city parameter in a registration action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3193 
SQL injection vulnerability in the DigiFolio (com_digifolio) component 1.52 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a project action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3194 
Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech SearchFeed Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3195 
Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech Auction RSS Content Script 3.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) rss.php and (2) search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3196 
Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech PHP Video Script allows remote attackers to inject arbitrary web script or HTML via the key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3197 
Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech PHP Calendars Script allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3198 
Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech Affiliate Master Datafeed Parser Script 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3199 
Uebimiau Webmail 3.2.0-2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database with usernames and password hashes via a direct request for system_admin/admin.ucf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T21:00:00.000Z
CVE-2009-3200 
The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 0627, and 3.1.1 0815 create an undocumented recovery key and store it in the ENCK variable in flash memory, which allows local users to bypass the passphrase requirement and decrypt the hard drive by reading this variable, deobfuscating the key, and running a cryptsetup luksOpen command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-21T19:00:00.000Z
CVE-2009-3201 
Integer overflow in Media Player Classic 6.4.9 allows user-assisted remote attackers to cause a denial of service (application crash) via a MIDI file (.mid) with a malformed header, which triggers a buffer overflow, a different vulnerability than CVE-2007-4940.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-15T23:00:00.000Z
CVE-2009-3202 
Cross-site scripting (XSS) vulnerability in search.php in ULoKI PHP Forum 2.1 allows remote attackers to inject arbitrary web script or HTML via the term parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3203 
SQL injection vulnerability in store.php in AJ Auction Pro OOPD 2.x allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3204 
Multiple cross-site scripting (XSS) vulnerabilities in Stiva Forum 1.0 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) demo.php and (2) forum.php, and the PATH_INFO to (3) include_forum.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3205 
SQL injection vulnerability in main.php in CBAuthority allows remote attackers to execute arbitrary SQL commands via the id parameter in a view_product action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3206 
Multiple cross-site scripting (XSS) vulnerabilities in the ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, allow remote authenticated users, with "administer imagecache" permissions, to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3207 
The ImageCache module 5.x before 5.x-2.5 and 6.x before 6.x-2.0-beta10, a module for Drupal, when the private file system is used, does not properly perform access control for derivative images, which allows remote attackers to view arbitrary images via a request that specifies an image's filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3208 
Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to permalink.php and (2) year parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3209 
SQL injection vulnerability in remove.php in PHP eMail Manager 3.3.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3210 
Multiple cross-site scripting (XSS) vulnerabilities in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.8 and 6.x before 6.x-1.8, a module for Drupal, allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3211 
Directory traversal vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the options[style_dir] parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3212 
SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3213 
Stack-based buffer overflow in broid 1.0 Beta 3a allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long string in a .mp3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3214 
Multiple stack-based buffer overflows in Photodex ProShow Gold 4.0.2549 allow remote attackers to execute arbitrary code via a crafted Slideshow project (.psh) file, related to the (1) cell[n].images[m].image and (2) cell[n].sound.file fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T17:00:00.000Z
CVE-2009-3215 
SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, and the IXXO Cart component for Joomla! 1.0.x, allows remote attackers to execute arbitrary SQL commands via the parent parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3216 
Multiple directory traversal vulnerabilities in iWiccle 1.01, when magic_quotes_gpc is disabled, allow remote attackers to read arbitrary files via a .. (dot dot) in (1) the show parameter to the admin module, reachable through index.php; or (2) the module parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3217 
SQL injection vulnerability in the admin module in iWiccle 1.01 allows remote attackers to execute arbitrary SQL commands via the member_id parameter in an edit_user action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3218 
SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3219 
Directory traversal vulnerability in a.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the a parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3220 
PHP remote file inclusion vulnerability in cp_html2txt.php in All In One Control Panel (AIOCP) 1.4.001 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3221 
Stack-based buffer overflow in Audio Lib Player (ALP) allows remote attackers to execute arbitrary code via a long URL in a .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3222 
Cross-site scripting (XSS) vulnerability in index.php in FreeWebScriptz Honest Traffic (FWSHT) 1.x allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3223 
SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3224 
SQL injection vulnerability in index.php in Super Mod System, when using the 68 Classifieds 3.1 Core System, allows remote attackers to execute arbitrary SQL commands via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3225 
Multiple cross-site scripting (XSS) vulnerabilities in AlmondSoft Almond Classifieds Wap and Pro, and possibly Almond Affiliate Network Classifieds, allow remote attackers to inject arbitrary web script or HTML via (1) the page parameter in a browse action to index.php or (2) the addr parameter to gmap.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3226 
SQL injection vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to execute arbitrary SQL commands via the replid parameter in a manw_repl add_form action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3227 
Cross-site scripting (XSS) vulnerability in index.php in AlmondSoft Almond Classifieds Ads Enterprise and Almond Affiliate Network Classifieds allows remote attackers to inject arbitrary web script or HTML via the city parameter in a search action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-16T19:00:00.000Z
CVE-2009-3228 
The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem in the Linux kernel 2.4.x before 2.4.37.6 and 2.6.x before 2.6.31-rc9 does not initialize certain (1) tcm__pad1 and (2) tcm__pad2 structure members, which might allow local users to obtain sensitive information from kernel memory via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-10-19T19:27:00.000Z
CVE-2009-3229 
The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by "re-LOAD-ing" libraries from a certain plugins directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3230 
The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges.  NOTE: this is due to an incomplete fix for CVE-2007-6600.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3231 
The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3232 
pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian GNU/Linux, does not properly handle an "empty selection" for system authentication modules in certain rare configurations, which causes any attempt to be successful and allows remote attackers to bypass authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3233 
changetrack 4.3 allows local users to execute arbitrary commands via CRLF sequences and shell metacharacters in a filename in a directory that is checked by changetrack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3234 
Buffer overflow in the perf_copy_attr function in kernel/perf_counter.c in the Linux kernel 2.6.31-rc1 allows local users to cause a denial of service (crash) and execute arbitrary code via a "big size data" to the perf_counter_open system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3235 
Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3236 
The form library in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; reuses temporary filenames during the upload process which allows remote attackers, with privileges to write to the address book, to overwrite arbitrary files and execute PHP code via crafted Horde_Form_Type_image form field elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3237 
Multiple cross-site scripting (XSS) vulnerabilities in Horde Application Framework 3.2 before 3.2.5 and 3.3 before 3.3.5; Groupware 1.1 before 1.1.6 and 1.2 before 1.2.4; and Groupware Webmail Edition 1.1 before 1.1.6 and 1.2 before 1.2.4; allow remote attackers to inject arbitrary web script or HTML via the (1) crafted number preferences that are not properly handled in the preference system (services/prefs.php), as demonstrated by the sidebar_width parameter; or (2) crafted unknown MIME "text parts" that are not properly handled in the MIME viewer library (config/mime_drivers.php).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-17T10:00:00.000Z
CVE-2009-3238 
The get_random_int function in drivers/char/random.c in the Linux kernel before 2.6.30 produces insufficiently random numbers, which allows attackers to predict the return value, and possibly defeat protection mechanisms based on randomization, via vectors that leverage the function's tendency to "return the same value over and over again for long stretches of time."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-3240 
Cross-site scripting (XSS) vulnerability in the Happy Linux XF-Section module 1.12a for XOOPS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-3241 
Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark 0.99.6 through 1.0.8 and 1.2.0 through 1.2.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via malformed OPCUA Service CallRequest packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-3242 
Unspecified vulnerability in packet.c in the GSM A RR dissector in Wireshark 1.2.0 and 1.2.1 allows remote attackers to cause a denial of service (application crash) via unknown vectors related to "an uninitialized dissector handle," which triggers an assertion failure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-3243 
Unspecified vulnerability in the TLS dissector in Wireshark 1.2.0 and 1.2.1, when running on Windows, allows remote attackers to cause a denial of service (application crash) via unknown vectors related to TLS 1.2 conversations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-3244 
Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long PlayerVersion property value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T10:00:00.000Z
CVE-2009-3245 
OpenSSL before 0.9.8m does not check for a NULL return value from bn_wexpand function calls in (1) crypto/bn/bn_div.c, (2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and (4) engines/e_ubsec.c, which has unspecified impact and context-dependent attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-05T19:00:00.000Z
CVE-2009-3246 
SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX allows remote attackers to execute arbitrary SQL commands via the id parameter in an spnews action to the default URI.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T20:00:00.000Z
CVE-2009-3247 
Cross-site scripting (XSS) vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php.  NOTE: the query_string vector is already covered by CVE-2008-3101.3.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T20:00:00.000Z
CVE-2009-3248 
Cross-site request forgery (CSRF) vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-09-18T20:00:00.000Z