rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-2861 
Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to (1) CFIDE/administrator/settings/mappings.cfm, (2) logging/settings.cfm, (3) datasources/index.cfm, (4) j2eepackaging/editarchive.cfm, and (5) enter.cfm in CFIDE/administrator/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-11T18:00:00.000Z
CVE-2010-2862 
Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-05T18:00:00.000Z
CVE-2010-2863 
Adobe Shockwave Player before 11.5.8.612 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2864 
IML32.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a malformed file containing an invalid value, as demonstrated by a value at position 0x24C6 of a certain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2865 
Unspecified vulnerability in Adobe Shockwave Player before 11.5.8.612 allows attackers to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2866 
Integer signedness error in the DIRAPI module in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a count value associated with an "undocumented structure" and the tSAC chunk in a Director movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2867 
DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly handle a certain return value associated with the rcsL chunk in a Director movie, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie, related to a "pointer offset vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2868 
IML32.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a malformed file containing an invalid value, as demonstrated by a value at position 0x320D of a certain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2869 
IML32.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a malformed file containing an invalid value, as demonstrated by a value at position 0x3712 of a certain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2870 
DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly validate a certain chunk size in the mmap chunk in a Director movie, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2871 
Integer overflow in the 3D object functionality in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted size value in a 0xFFFFFF45 RIFF record in a Director movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2872 
Adobe Shockwave Player before 11.5.8.612 does not properly validate an offset value in the pami RIFF chunk in a Director movie, which allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2873 
Adobe Shockwave Player before 11.5.8.612 does not properly validate offset values in the rcsL RIFF chunks of (1) .DIR and (2) .DCR Director movies, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2874 
Unspecified vulnerability in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to execute arbitrary code via unknown vectors that trigger memory corruption.  NOTE: due to conflicting information and use of the same CVE identifier by the vendor, ZDI, and TippingPoint, it is not clear whether this issue is related to use of an uninitialized pointer, an incorrect pointer offset calculation, or both.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-07T17:00:00.000Z
CVE-2010-2875 
Integer signedness error in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a length value associated with the tSAC chunk in a Director movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2876 
Adobe Shockwave Player before 11.5.8.612 does not properly validate values associated with buffer-size calculation for a 0xFFFFFFF8 record in a (1) .dir or (2) .dcr Director movie, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2877 
Adobe Shockwave Player before 11.5.8.612 does not properly validate a count value in a Director movie, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie, related to IML32X.dll and DIRAPIX.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2878 
DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly validate a value associated with a buffer seek for a Director movie, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2879 
Multiple integer overflows in the allocator in the TextXtra.x32 module in Adobe Shockwave Player before 11.5.8.612 allow remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted (1) element count or (2) element size value in a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2880 
DIRAPI.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a malformed file containing an invalid value, as demonstrated by a value at position 0x47 of a certain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2881 
IML32.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a malformed file containing an invalid value, as demonstrated by a value at position 0x24C0 of a certain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2882 
DIRAPI.dll in Adobe Shockwave Player before 11.5.8.612 does not properly parse .dir files, which allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a malformed file containing an invalid value, as demonstrated by a value at position 0x3812 of a certain file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-26T20:00:00.000Z
CVE-2010-2883 
Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-09T21:00:00.000Z
CVE-2010-2884 
Adobe Flash Player 10.1.82.76 and earlier on Windows, Mac OS X, Linux, and Solaris and 10.1.92.10 on Android; authplay.dll in Adobe Reader and Acrobat 9.x before 9.4; and authplay.dll in Adobe Reader and Acrobat 8.x before 8.2.5 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in September 2010.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-15T17:26:00.000Z
CVE-2010-2885 
Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 7 and 8, and RoboHelp Server 7 and 8, allows remote attackers to inject arbitrary web script or HTML via vectors related to WebHelp generation with RoboHelp for Word.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-26T18:00:00.000Z
CVE-2010-2886 
Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 7 and 8, and RoboHelp Server 7 and 8, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-26T18:00:00.000Z
CVE-2010-2887 
Multiple unspecified vulnerabilities in Adobe Reader and Acrobat 9.x before 9.4 on Linux allow attackers to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-06T16:00:00.000Z
CVE-2010-2888 
Multiple unspecified vulnerabilities in an ActiveX control in Adobe Reader and Acrobat 8.x before 8.2.5 and 9.x before 9.4 on Windows allow attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-06T16:00:00.000Z
CVE-2010-2889 
Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows attackers to execute arbitrary code via a crafted font, a different vulnerability than CVE-2010-3626.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-06T16:00:00.000Z
CVE-2010-2890 
Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-3619, CVE-2010-3621, CVE-2010-3622, CVE-2010-3628, CVE-2010-3632, and CVE-2010-3658.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-06T16:00:00.000Z
CVE-2010-2891 
Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an Object Identifier (aka OID) represented as a numerical string containing many components separated by . (dot) characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-27T22:00:00.000Z
CVE-2010-2892 
gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery (CSRF) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-15T20:00:00.000Z
CVE-2010-2896 
IBM FileNet Content Manager (CM) 4.0.0, 4.0.1, 4.5.0, and 4.5.1 before FP4 does not properly manage the InheritParentPermissions setting during an upgrade from 3.x, which might allow attackers to bypass intended folder permissions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2897 
Google Chrome before 5.0.375.125 does not properly mitigate an unspecified flaw in the Windows kernel, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2898 
Google Chrome before 5.0.375.125 does not properly mitigate an unspecified flaw in the GNU C Library, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2899 
Unspecified vulnerability in the layout implementation in Google Chrome before 5.0.375.125 allows remote attackers to obtain sensitive information from process memory via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2900 
Google Chrome before 5.0.375.125 does not properly handle a large canvas, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2901 
The rendering implementation in Google Chrome before 5.0.375.125 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2902 
The SVG implementation in Google Chrome before 5.0.375.125 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2903 
Google Chrome before 5.0.375.125 performs unexpected truncation and improper eliding of hostnames, which has unspecified impact and remote attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T19:32:00.000Z
CVE-2010-2904 
Multiple cross-site scripting (XSS) vulnerabilities in the System Landscape Directory (SLD) component 6.4 through 7.02 in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via the (1) action parameter to testsdic and the (2) helpstring parameter to paramhelp.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2905 
SQL injection vulnerability in info.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2906 
SQL injection vulnerability in articlesdetails.php in ScriptsFeed and BrotherScripts (BS) Scripts Directory allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2010-2905.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2907 
SQL injection vulnerability in the Huru Helpdesk (com_huruhelpdesk) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid[0] parameter in a detail action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2908 
SQL injection vulnerability in the Joomdle (com_joomdle) component 0.24 and earlier for Joomla! allows remote attackers to execute arbitrary SQL commands via the course_id parameter in a detail action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2909 
SQL injection vulnerability in ttvideo.php in the TTVideo (com_ttvideo) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in a video action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2910 
SQL injection vulnerability in the Ozio Gallery (com_oziogallery) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the Itemid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2911 
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL commands via the newsid parameter in a viewnews action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2912 
SQL injection vulnerability in index.php in Kayako eSupport 3.70.02 allows remote attackers to execute arbitrary SQL commands via the _a parameter in a downloads action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-28T21:00:00.000Z
CVE-2010-2913 
The Citibank Citi Mobile app before 2.0.3 for iOS stores account data in a file, which allows local users to obtain sensitive information via vectors involving (1) the mobile device or (2) a synchronized computer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-29T18:00:00.000Z
CVE-2010-2914 
Cross-site scripting (XSS) vulnerability in nessusd_www_server.nbin in the Nessus Web Server plugin 1.2.4 for Nessus allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2915 
SQL injection vulnerability in welcome.php in AJ Square AJ HYIP PRIME allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2916 
SQL injection vulnerability in news.php in AJ Square AJ HYIP MERIDIAN allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2917 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in AJ Square AJ Article 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) emailid, (2) fname, (3) lname, (4) company, (5) address1, (6) address2, (7) city, (8) state, (9) zipcode, (10) phone, and (11) fax parameters in an update action.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2918 
PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites (com_joomla-visites) component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2919 
SQL injection vulnerability in the StaticXT (com_staticxt) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2920 
Directory traversal vulnerability in the Foobla Suggestions (com_foobla_suggestions) component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2921 
SQL injection vulnerability in the Golf Course Guide (com_golfcourseguide) component 0.9.6.0 beta and 1 beta for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a golfcourses action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2922 
SQL injection vulnerability in default.asp in AKY Blog allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2923 
SQL injection vulnerability in the YouTube (com_youtube) component 1.5 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id_cate parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2924 
SQL injection vulnerability in myLDlinker.php in the myLinksDump Plugin 1.2 for WordPress allows remote attackers to execute arbitrary SQL commands via the url parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2925 
SQL injection vulnerability in index.php in Freeway CMS 1.4.3.210 allows remote attackers to execute arbitrary SQL commands via the ecPath parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2926 
SQL injection vulnerability in index.php in sNews 1.7 allows remote attackers to execute arbitrary SQL commands via the category parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-07-30T20:00:00.000Z
CVE-2010-2927 
The slapi_printmessage function in IBM Tivoli Directory Server (ITDS) before 6.0.0.8-TIV-ITDS-IF0006 allows remote attackers to cause a denial of service (daemon crash) via multiple incomplete DIGEST-MD5 connection attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-02T19:00:00.000Z
CVE-2010-2928 
The vCenter Tomcat Management Application in VMware vCenter Server 4.1 before Update 1 stores log-on credentials in a configuration file, which allows local users to gain privileges by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-16T00:00:00.000Z
CVE-2010-2929 
Untrusted search path vulnerability in hsolinkcontrol in hsolink 1.0.118 allows local users to gain privileges via a modified PATH environment variable, which is used during execution of the (1) route, (2) mv, and (3) cp programs, a different vulnerability than CVE-2010-1671.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-08-02T20:00:00.000Z