rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-5341 
Multiple cross-site scripting (XSS) vulnerabilities in statistik.php in Otterware StatIt 4 allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter, (2) show parameter in a stat_tld action, or (3) order parameter in a stat_abfragen action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5342 
Multiple SQL injection vulnerabilities in SenseSites CommonSense CMS allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) special.php, (2) article.php, or (3) cat2.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5343 
Cross-site scripting (XSS) vulnerability in admin/login.php in Limny 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, related to the "PHP_SELF" variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5344 
Directory traversal vulnerability in the WebServer (Thttpd.bat) in IpTools (aka Tiny TCP/IP server) 0.1.4 allows remote attackers to read arbitrary files via a .. (dot dot) in a HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5345 
Buffer overflow in the Remote command server (Rcmd.bat) in IpTools (aka Tiny TCP/IP server) 0.1.4 allows remote attackers to cause a denial of service (crash) via a long string to TCP port 23.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5346 
Cross-site scripting (XSS) vulnerability in wp-live.php in the WP Live.php module 1.2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5347 
TinyWebGallery 1.8.3 allows remote attackers to execute arbitrary code via shell metacharacters in the command parameter to (1) inc/filefunctions.inc or (2) info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5348 
SQL injection vulnerability in MangosWeb Enhanced 3.0.3 allows remote attackers to execute arbitrary SQL commands via the login parameter in a login action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5349 
Multiple cross-site scripting (XSS) vulnerabilities in pay.php in the Pay With Tweet plugin before 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) title, or (3) dl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5350 
SQL injection vulnerability in the Pay With Tweet plugin before 1.2 for WordPress allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the id parameter in a paywithtweet shortcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T15:00:00.000Z
CVE-2012-5351 
Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-5352 
Java Open Single Sign-On Project Home (JOSSO) allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-5353 
Eduserv OpenAthens SP 2.0 for Java allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-5354 
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly handle navigation away from a web page that has multiple menus of SELECT elements active, which allows remote attackers to conduct clickjacking attacks via vectors involving an XPI file, the window.open method, and the Geolocation API, a different vulnerability than CVE-2012-3984.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-5355 
welcome.py in xdiagnose before 2.5.2ubuntu0.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-5356 
The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-5357 
Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T14:00:00.000Z
CVE-2012-5358 
The XSLTCompiledTransform function in Ektron Content Management System (CMS) before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or possibly have unspecified other impact via crafted XSL data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T14:00:00.000Z
CVE-2012-5359 
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2012-5360 
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2012-5361 
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-03-20T16:00:00.000Z
CVE-2012-5362 
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2010-4669.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:22:34.000Z
CVE-2012-5363 
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2011-2393.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:24:37.000Z
CVE-2012-5364 
The IPv6 implementation in Microsoft Windows 7 and earlier allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:16:52.000Z
CVE-2012-5365 
The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:20:16.000Z
CVE-2012-5366 
The IPv6 implementation in Apple Mac OS X (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T14:14:26.000Z
CVE-2012-5367 
Multiple SQL injection vulnerabilities in OrangeHRM 2.7.1 RC 1 allow remote authenticated administrators to execute arbitrary SQL commands via the sortField parameter to (1) viewCustomers, (2) viewPayGrades, or (3) viewSystemUsers in symfony/web/index.php/admin/, as demonstrated using cross-site request forgery (CSRF) attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-5368 
phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T10:00:00.000Z
CVE-2012-5370 
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-28T11:00:00.000Z
CVE-2012-5371 
Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-28T11:00:00.000Z
CVE-2012-5372 
Rubinius computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-28T11:00:00.000Z
CVE-2012-5373 
Oracle Java SE 7 and earlier, and OpenJDK 7 and earlier, computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash3 algorithm, a different vulnerability than CVE-2012-2739.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-28T11:00:00.000Z
CVE-2012-5374 
The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (extended runtime of kernel code) by creating many different files whose names are associated with the same CRC32C hash value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T11:00:00.000Z
CVE-2012-5375 
The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (prevention of file creation) by leveraging the ability to write to a directory important to the victim, and creating a file with a crafted name that is associated with a specific CRC32C hash value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T11:00:00.000Z
CVE-2012-5376 
The Inter-process Communication (IPC) implementation in Google Chrome before 22.0.1229.94 allows remote attackers to bypass intended sandbox restrictions and write to arbitrary files by leveraging access to a renderer process, a different vulnerability than CVE-2012-5112.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5377 
Untrusted search path vulnerability in the installation functionality in ActivePerl 5.16.1.1601, when installed in the top-level C:\ directory, allows local users to gain privileges via a Trojan horse DLL in the C:\Perl\Site\bin directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5378 
Untrusted search path vulnerability in the installation functionality in ActiveTcl 8.5.12, when installed in the top-level C:\ directory, allows local users to gain privileges via a Trojan horse DLL in the C:\TD\bin directory, which is added to the PATH system environment variable, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5379 
Untrusted search path vulnerability in the installation functionality in ActivePython 3.2.2.3, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Python27 or C:\Python27\Scripts directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.  NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the ActivePython installation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5380 
Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.  NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5381 
Untrusted search path vulnerability in the installation functionality in PHP 5.3.17, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\PHP directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview.  NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the PHP installation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5382 
Untrusted search path vulnerability in the installation functionality in Zend Server 5.6.0 SP4, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Zend\ZendServer\share\ZendFramework\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the choice of C:\ (and the resulting unsafe PATH) is established by an administrative action that is not a default part of the Zend Server installation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5383 
Untrusted search path vulnerability in the installation functionality in Oracle MySQL 5.5.28, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the "C:\MySQL\MySQL Server 5.5\bin" directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the MySQL installation
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T10:00:00.000Z
CVE-2012-5384 
Multiple cross-site scripting (XSS) vulnerabilities in Craig Knudsen WebCalendar allow remote attackers to inject arbitrary web script or HTML via the (1) $name or (2) $description variables in edit_entry_handler.php, or (3) $url, (4) $tempfullname, or (5) $ext_users[] variables in view_entry.php, different vectors than CVE-2012-0846.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T15:00:00.000Z
CVE-2012-5385 
install/index.php in Craig Knudsen WebCalendar before 1.2.5 allows remote attackers to modify settings.php and possibly execute arbitrary code via vectors related to the user theme preference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T15:00:00.000Z
CVE-2012-5386 
Directory traversal vulnerability in index.php in phpPaleo 4.8b180 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the phppaleo4_lang cookie, a different vulnerability than CVE-2012-1671.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-11T15:00:00.000Z
CVE-2012-5387 
Cross-site request forgery (CSRF) vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, as demonstrated by a developer name containing XSS sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-24T10:00:00.000Z
CVE-2012-5388 
Cross-site scripting (XSS) vulnerability in wlcms-plugin.php in the White Label CMS plugin 1.5 for WordPress allows remote authenticated administrators to inject arbitrary web script or HTML via the wlcms_o_developer_name parameter in a save action to wp-admin/admin.php, a related issue to CVE-2012-5387.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-24T10:00:00.000Z
CVE-2012-5389 
NULL Pointer Dereference in PowerTCP WebServer for ActiveX 1.9.2 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T21:29:23.000Z
CVE-2012-5390 
The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 through 7.7.6, 7.8.0 before 7.8.5, and 7.9.0 does no properly check privileges, which allows remote attackers to gain privileges via a crafted standard universe job.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-06T14:00:00.000Z
CVE-2012-5391 
Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2012-5394 
Cross-site request forgery (CSRF) vulnerability in the CentralAuth extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to hijack the authentication of users for requests that login via vectors involving image loading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-13T18:00:00.000Z
CVE-2012-5395 
Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-02T15:00:00.000Z
CVE-2012-5409 
AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-01T10:00:00.000Z
CVE-2012-5415 
Race condition on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (CPU consumption or device reload) by establishing multiple connections, leading to improper handling of hash lookups for secondary flows, aka Bug IDs CSCue31622 and CSCuc71272.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-16T10:00:00.000Z
CVE-2012-5416 
Buffer overflow in Cisco Unified MeetingPlace Web Conferencing before 7.1MR1 Patch 1, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 allows remote attackers to cause a denial of service (daemon hang) via unspecified parameters in a POST request, aka Bug ID CSCua66341.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-02T01:00:00.000Z
CVE-2012-5417 
Cisco Prime Data Center Network Manager (DCNM) before 6.1(1) does not properly restrict access to certain JBoss MainDeployer functionality, which allows remote attackers to execute arbitrary commands via JBoss Application Server Remote Method Invocation (RMI) services, aka Bug ID CSCtz44924.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-02T01:00:00.000Z