rainbutterfly/cve_corpus huggingface dataset:
CVE-2009-4491 
thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-13T00:00:00.000Z
CVE-2009-4492 
WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-13T20:00:00.000Z
CVE-2009-4493 
Orion Application Server 2.0.7 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-13T20:00:00.000Z
CVE-2009-4494 
AOLserver 4.5.1 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-13T20:00:00.000Z
CVE-2009-4495 
Yaws 1.85 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-13T20:00:00.000Z
CVE-2009-4496 
Boa 0.94.14rc21 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-13T20:00:00.000Z
CVE-2009-4497 
Cross-site scripting (XSS) vulnerability in LXR Cross Referencer 0.9.5 and 0.9.6 allows remote attackers to inject arbitrary web script or HTML via the i parameter to the ident program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-07T19:00:00.000Z
CVE-2009-4498 
The node_process_command function in Zabbix Server before 1.8 allows remote attackers to execute arbitrary commands via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T18:00:00.000Z
CVE-2009-4499 
SQL injection vulnerability in the get_history_lastid function in the nodewatcher component in Zabbix Server before 1.6.8 allows remote attackers to execute arbitrary SQL commands via a crafted request, possibly related to the send_history_last_id function in zabbix_server/trapper/nodehistory.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T18:00:00.000Z
CVE-2009-4500 
The process_trap function in trapper/trapper.c in Zabbix Server before 1.6.6 allows remote attackers to cause a denial of service (crash) via a crafted request with data that lacks an expected : (colon) separator, which triggers a NULL pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T18:00:00.000Z
CVE-2009-4501 
The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix Server before 1.6.8 allows remote attackers to cause a denial of service (crash) via a request that lacks expected separators, which triggers a NULL pointer dereference, as demonstrated using the Command keyword.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T18:00:00.000Z
CVE-2009-4502 
The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen.  NOTE: this attack is limited to attacks from trusted IP addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T18:00:00.000Z
CVE-2009-4505 
Multiple cross-site scripting (XSS) vulnerabilities in OpenCMS OAMP Comments Module 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the name field in a comment, and other unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-03-26T18:00:00.000Z
CVE-2009-4509 
The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg/web/lib/secure.php and (2) tandberg/web/user/lib/secure.php, which makes it easier for remote attackers to bypass authentication, and execute arbitrary code by loading a custom software update, via a crafted "Cookie: tandberg_login=" HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-13T17:00:00.000Z
CVE-2009-4510 
The SSH service on the TANDBERG Video Communication Server (VCS) before X5.1 uses a fixed DSA key, which makes it easier for remote attackers to conduct man-in-the-middle attacks and spoof arbitrary servers via crafted SSH packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-13T17:00:00.000Z
CVE-2009-4511 
Multiple directory traversal vulnerabilities in the web administration interface on the TANDBERG Video Communication Server (VCS) before X5.1 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the page parameter to (1) helppage.php or (2) user/helppage.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-04-13T17:00:00.000Z
CVE-2009-4512 
Directory traversal vulnerability in index.php in Oscailt 3.3, when Use Friendly URL's is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the obj_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4513 
Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with "administer workflow" privileges, to inject arbitrary web script or HTML via the name of a (1) workflow or (2) workflow state.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4514 
Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows remote authenticated users, with "create application" privileges, to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4515 
The Storm module 6.x before 6.x-1.25 for Drupal does not enforce privilege requirements for storminvoiceitem nodes, which allows remote attackers to read node titles via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4516 
Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4517 
Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4518 
Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x before 5.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via an inserted node.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4519 
Multiple unspecified vulnerabilities in Ortro before 1.3.4 have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4520 
The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended access restrictions and read comments by using the autocomplete path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4521 
Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse Business Intelligence and Reporting Tools (BIRT) before 2.5.0, as used in KonaKart and other products, allows remote attackers to inject arbitrary web script or HTML via the __report parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4522 
Cross-site scripting (XSS) vulnerability in search.5.html in BloofoxCMS 0.3.5 allows remote attackers to inject arbitrary web script or HTML via the search parameter to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4523 
Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 allows remote attackers to inject arbitrary web script or HTML via the searchSongKeyword parameter in a SearchSong action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4524 
Cross-site scripting (XSS) vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname (aka real name) element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4525 
Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via crafted data in a list of links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4526 
The Send by e-mail sub-module in the Print (aka Printer, e-mail and PDF versions) module 5.x before 5.x-4.9 and 6.x before 6.x-1.9, a module for Drupal, does not properly enforce privilege requirements, which allows remote attackers to read page titles by requesting a "Send to friend" form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4527 
The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before 6.x-3.2, a module for Drupal, does not properly remove statically granted privileges after a logout or other session change, which allows physically proximate attackers to gain privileges by using an unattended web browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4528 
The Organic Groups (OG) Vocabulary module 6.x before 6.x-1.0 for Drupal allows remote authenticated group members to bypass intended access restrictions, and create, modify, or read a vocabulary, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4529 
InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote attackers to obtain the source code for a web page via a trailing encoded space character in a URI, as demonstrated by /index.html%20 and /index.php%20 URIs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4530 
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending ::$DATA to the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4531 
httpdx 1.4.4 and earlier allows remote attackers to obtain the source code for a web page by appending a . (dot) character to the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4532 
Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote authenticated users, with webform creation privileges, to inject arbitrary web script or HTML via a field label.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4533 
The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4534 
Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4535 
Mongoose 2.8.0 and earlier allows remote attackers to obtain the source code for a web page by appending a / (slash) character to the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2009-12-31T19:00:00.000Z
CVE-2009-4536 
drivers/net/e1000/e1000_main.c in the e1000 driver in the Linux kernel 2.6.32.3 and earlier handles Ethernet frames that exceed the MTU by processing certain trailing payload data as if it were a complete frame, which allows remote attackers to bypass packet filters via a large packet with a crafted payload.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1385.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-12T17:00:00.000Z
CVE-2009-4537 
drivers/net/r8169.c in the r8169 driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to (1) cause a denial of service (temporary network outage) via a packet with a crafted size, in conjunction with certain packets containing A characters and certain packets containing E characters; or (2) cause a denial of service (system crash) via a packet with a crafted size, in conjunction with certain packets containing '\0' characters, related to the value of the status register and erroneous behavior associated with the RxMaxSize register.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2009-1389.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-12T17:00:00.000Z
CVE-2009-4538 
drivers/net/e1000e/netdev.c in the e1000e driver in the Linux kernel 2.6.32.3 and earlier does not properly check the size of an Ethernet frame that exceeds the MTU, which allows remote attackers to have an unspecified impact via crafted packets, a related issue to CVE-2009-4537.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-12T17:00:00.000Z
CVE-2009-4539 
Cross-site scripting (XSS) vulnerability in main.php in SQLiteManager 1.2.0 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4540 
SQL injection vulnerability in page.php in Mini CMS 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4541 
Multiple PHP remote file inclusion vulnerabilities in IsolSoft Support Center 2.5 allow remote attackers to execute arbitrary PHP code via a URL in the lang parameter to (1) newticket.php or (2) rempass.php, or a URL in the lang parameter in an adduser action to (3) index.php. NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4542 
Cross-site scripting (XSS) vulnerability in newticket.php in IsolSoft Support Center 2.5 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4543 
PHP remote file inclusion vulnerability in index.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to execute arbitrary PHP code via a URL in the lng parameter.  NOTE: this can also be leveraged to include and execute arbitrary local files via .. (dot dot) sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4544 
Cross-site scripting (XSS) vulnerability in kbase/kbase.php in Cromosoft Technologies Facil Helpdesk 2.3 Lite allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4545 
Logoshows BBS 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/globepersonnel.mdb.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4546 
globepersonnel_login.asp in Logoshows BBS 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the (1) pb_username (aka pb%5Fusername) and (2) level cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4547 
Multiple cross-site scripting (XSS) vulnerabilities in ViArt CMS 3.x allow remote attackers to inject arbitrary web script or HTML via the (1) category_id parameter to forums.php, or the forum_id parameter to (2) forum.php or (3) forum_topic_new.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4548 
Multiple cross-site scripting (XSS) vulnerabilities in ViArt Helpdesk 3.x allow remote attackers to inject arbitrary web script or HTML via the category_id parameter to (1) products.php, (2) article.php, (3) product_details.php, or (4) reviews.php; the (5) forum_id parameter to forum.php; or the (6) search_category_id parameter to products_search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4549 
Stack-based buffer overflow in A2 Media Player Pro 2.51 allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .m3l playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4550 
SQL injection vulnerability in the Kunena Forum (com_kunena) component 1.5.3 and 1.5.4 for Joomla! allows remote attackers to execute arbitrary SQL commands via the func parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4551 
SQL injection vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to execute arbitrary SQL commands via the campaign_id parameter in a results action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4552 
Cross-site scripting (XSS) vulnerability in the Survey Pro module for Miniweb 2.0 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4553 
Stack-based buffer overflow in iRehearse allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a long string in a .m3u playlist file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T17:00:00.000Z
CVE-2009-4554 
Multiple cross-site scripting (XSS) vulnerabilities in Snitz Forums 2000 3.4.07 allow remote attackers to inject arbitrary web script or HTML via (1) the url parameter to pop_send_to_friend.asp, related to a crafted onload attribute of an IMG element; or (2) an onload attribute in a sound tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T21:00:00.000Z
CVE-2009-4555 
Multiple cross-site request forgery (CSRF) vulnerabilities in AgoraCart 5.2.005 and 5.2.006 and AgoraCart GOLD 5.5.005 allow remote attackers to hijack the authentication of administrators for requests that (1) modify a .htaccess file via an unspecified request to protected/manager.cgi or (2) change the password of an administrative account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T21:00:00.000Z
CVE-2009-4556 
Quick Heal AntiVirus Plus 2009 10.00 SP1 and Quick Heal Total Security 2009 10.00 SP1 use weak permissions (Everyone: Full Control) for the product files, which allows local users to gain privileges by replacing executables with Trojan horse programs, as demonstrated by replacing quhlpsvc.exe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T21:00:00.000Z
CVE-2009-4557 
Cross-site scripting (XSS) vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node creation privileges, to inject arbitrary web script or HTML via a node title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T21:00:00.000Z
CVE-2009-4558 
The Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, does not properly enforce privilege requirements for unspecified pages, which allows remote attackers to read the (1) title or (2) body of an arbitrary node via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T21:00:00.000Z
CVE-2009-4559 
Cross-site scripting (XSS) vulnerability in the Submitted By module 6.x before 6.x-1.3 for Drupal allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via an input string for "submitted by" text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-01-04T21:00:00.000Z