rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-2745 
upload_handler.php in the swfupload extension in Chyrp 2.0 and earlier relies on client-side JavaScript code to restrict the file extensions of uploaded files, which allows remote authenticated users to upload a .php file, and consequently execute arbitrary PHP code, via a write_post action to the default URI under admin/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T01:29:00.000Z
CVE-2011-2746 
Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T15:00:00.000Z
CVE-2011-2747 
Google Picasa before 3.6 Build 105.67 does not properly handle invalid properties in JPEG images, which allows remote attackers to execute arbitrary code via a crafted image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-28T18:00:00.000Z
CVE-2011-2748 
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-15T21:00:00.000Z
CVE-2011-2749 
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-15T21:00:00.000Z
CVE-2011-2750 
NFRAgent.exe in Novell File Reporter 1.0.4.2 and earlier allows remote attackers to delete arbitrary files via a full pathname in an SRS OPERATION 4 CMD 5 request to /FSF/CMD.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2751 
SQL injection vulnerability in Parodia before 6.809 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2752 
CRLF injection vulnerability in SquirrelMail 1.4.21 and earlier allows remote attackers to modify or add preference values via a \n (newline) character, a different vulnerability than CVE-2010-4555.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2753 
Multiple cross-site request forgery (CSRF) vulnerabilities in SquirrelMail 1.4.21 and earlier allow remote attackers to hijack the authentication of unspecified victims via vectors involving (1) the empty trash implementation and (2) the Index Order (aka options_order) page, a different issue than CVE-2010-4555.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2754 
Cross-site scripting (XSS) vulnerability in the PageBuilder2 (aka Page Builder) theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006, as used in IBM Web Content Manager (WCM) and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2755 
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2756 
FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0 before Build 8012 does not require authentication, which allows remote attackers to read files from a specific directory via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2757 
Directory traversal vulnerability in FileDownload.jsp in ManageEngine ServiceDesk Plus 8.0.0.12 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the FILENAME parameter.  NOTE: this might overlap the US-CERT VU#543310 issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2758 
IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files, which allows remote attackers to obtain sensitive information via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2759 
The login page of IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2760 
Brocade BigIron RX switches allow remote attackers to bypass ACL rules by using 179 as the source port of a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2761 
Google Chrome 14.0.794.0 does not properly handle a reload of a page generated in response to a POST, which allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web site, related to GetWidget methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-18T22:00:00.000Z
CVE-2011-2762 
The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) allows remote attackers to bypass authentication via unspecified data associated with a "true" authentication status, related to AMF data and the LSRoom_Remoting.authenticate function in gateway.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-02T16:00:00.000Z
CVE-2011-2763 
The web interface on the LifeSize Room appliance LS_RM1_3.5.3 (11) and 4.7.18 allows remote attackers to execute arbitrary commands via a modified request to the LSRoom_Remoting.doCommand function in gateway.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-02T16:00:00.000Z
CVE-2011-2764 
The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-04T01:00:00.000Z
CVE-2011-2765 Insecure temporary file handling
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-08-20T13:00:00.000Z
CVE-2011-2766 
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T10:00:00.000Z
CVE-2011-2767 
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.
Problem types: description: code execution
Affected products: vendor: n/a
product: mod_perl 2.0 through 2.0.10
Published: 2018-08-26T16:00:00.000Z
CVE-2011-2768 
Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-23T02:00:00.000Z
CVE-2011-2769 
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-23T02:00:00.000Z
CVE-2011-2770 
Cross-site scripting (XSS) vulnerability in man2html.cgi.c in man2html 1.6, and possibly other version, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-2771 
Multiple cross-site scripting (XSS) vulnerabilities in Mahara before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) URI attributes and (2) the External Feed component, as demonstrated by the guid element in an RSS feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-15T02:00:00.000Z
CVE-2011-2772 
The get_dataroot_image_path function in lib/file.php in Mahara before 1.4.1 does not properly validate uploaded image files, which allows remote attackers to cause a denial of service (memory consumption) via a (1) large or (2) invalid image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-15T02:00:00.000Z
CVE-2011-2773 
Cross-site request forgery (CSRF) vulnerability in Mahara before 1.4.1 allows remote attackers to hijack the authentication of administrators for requests that add a user to an institution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-15T02:00:00.000Z
CVE-2011-2774 
The "Reply to message" feature in Mahara 1.3.x and 1.4.x before 1.4.1 allows remote authenticated users to read the messages of a different user via a modified replyto parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-15T02:00:00.000Z
CVE-2011-2776 
Buffer overflow in the Error function in super.c in Super 3.30.0 might allow local users to execute arbitrary code via vectors related to syslog logging.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-13T18:00:00.000Z
CVE-2011-2777 
samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-29T22:00:00.000Z
CVE-2011-2778 
Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by (1) establishing a SOCKS connection to SocksPort or (2) leveraging a SOCKS proxy configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-23T02:00:00.000Z
CVE-2011-2779 
Windows Event Log SmartConnector in HP ArcSight Connector Appliance before 6.1 uses world-writable permissions for exported report files, which allows local users to change or delete log data by modifying a file, a different vulnerability than CVE-2011-0770.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-19T21:00:00.000Z
CVE-2011-2780 
Directory traversal vulnerability in includes/lib/gz.php in Chyrp 2.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, a different vulnerability than CVE-2011-2744.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-19T21:00:00.000Z
CVE-2011-2782 
The drag-and-drop implementation in Google Chrome before 13.0.782.107 on Linux does not properly enforce permissions for files, which allows user-assisted remote attackers to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2783 
Google Chrome before 13.0.782.107 does not ensure that developer-mode NPAPI extension installations are confirmed by a browser dialog, which makes it easier for remote attackers to modify the product's functionality via a Trojan horse extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2784 
Google Chrome before 13.0.782.107 allows remote attackers to obtain sensitive information via a request for the GL program log, which reveals a local path in an unspecified log entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2785 
The extensions implementation in Google Chrome before 13.0.782.107 does not properly validate the URL for the home page, which allows remote attackers to have an unspecified impact via a crafted extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2786 
Google Chrome before 13.0.782.107 does not ensure that the speech-input bubble is shown on the product's screen, which might make it easier for remote attackers to make audio recordings via a crafted web page containing an INPUT element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2787 
Google Chrome before 13.0.782.107 does not properly address re-entrancy issues associated with the GPU lock, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2788 
Buffer overflow in the inspector serialization functionality in Google Chrome before 13.0.782.107 allows user-assisted remote attackers to have an unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2789 
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to instantiation of the Pepper plug-in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2790 
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving floating styles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2791 
The International Components for Unicode (ICU) functionality in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2792 
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to float removal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2793 
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media selectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2794 
Google Chrome before 13.0.782.107 does not properly perform text iteration, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2795 
Google Chrome before 13.0.782.107 does not prevent calls to functions in other frames, which allows remote attackers to bypass intended access restrictions via a crafted web site, related to a "cross-frame function leak."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2796 
Use-after-free vulnerability in Skia, as used in Google Chrome before 13.0.782.107, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2797 
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to resource caching.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2798 
Google Chrome before 13.0.782.107 does not properly restrict access to internal schemes, which allows remote attackers to have an unspecified impact via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2799 
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to HTML range handling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2800 
Google Chrome before 13.0.782.107 allows remote attackers to obtain potentially sensitive information about client-side redirect targets via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2801 
Use-after-free vulnerability in Google Chrome before 13.0.782.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the frame loader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2802 
Google V8, as used in Google Chrome before 13.0.782.107, does not properly perform const lookups, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2803 
Google Chrome before 13.0.782.107 does not properly handle Skia paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2804 
Google Chrome before 13.0.782.107 does not properly handle nested functions in PDF documents, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2805 
Google Chrome before 13.0.782.107 allows remote attackers to bypass the Same Origin Policy and conduct script injection attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2806 
Google Chrome before 13.0.782.215 on Windows does not properly handle vertex data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T15:00:00.000Z
CVE-2011-2807 
Incorrect handling of timer information in Timer.cpp in WebKit in Google Chrome before Blink M13.
Problem types: description: use-after-free
Affected products: vendor: Google
product: Chrome
Published: 2019-11-07T16:27:48.000Z
CVE-2011-2808 
A stale layout root is set as an input element in WebKit in Google Chrome before Blink M13 when a child of a keygen with autofocus is accessed.
Problem types: description: use of stale data
Affected products: vendor: Google
product: Chrome
Published: 2019-11-06T20:12:34.000Z
CVE-2011-2809 
WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-12T18:00:00.000Z
CVE-2011-2811 
WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-12T18:00:00.000Z
CVE-2011-2813 
WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-12T18:00:00.000Z
CVE-2011-2814 
WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-12T18:00:00.000Z
CVE-2011-2815 
WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-12T18:00:00.000Z
CVE-2011-2816 
WebKit, as used in Apple iTunes before 10.5, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-10-11-1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-12T18:00:00.000Z