rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-4184 
NetSupport Manager (NSM) before 11.00.0005 sends HTTP headers with cleartext fields containing details about client machines, which allows remote attackers to obtain potentially sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T16:28:00.000Z
CVE-2010-4185 
SQL injection vulnerability in index.php in Energine, possibly 2.3.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the NRGNSID cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T18:00:00.000Z
CVE-2010-4186 
SQL injection vulnerability in process.asp in OnlineTechTools Online Work Order System (OWOS) Professional Edition 2.10 allows remote attackers to execute arbitrary SQL commands via the password parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T18:00:00.000Z
CVE-2010-4187 
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed chunk in a Director file, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4190, CVE-2010-4191, CVE-2010-4192, and CVE-2010-4306.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4188 
The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with an IFWV chunk with a size field of 0, which is used in the calculation of a file offset and causes invalid data to be used as a loop counter, triggering a heap-based buffer overflow, a different vulnerability than CVE-2010-2587 and CVE-2010-2588.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4189 
The IML32 module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie containing a GIF image with a crafted global color table size value, which causes an out-of-range pointer offset.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4190 
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted CSWV RIFF chunk that causes an incorrect calculation of an offset for a substructure, which causes an out-of-bounds "seek" of heap memory, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4191, CVE-2010-4192, and CVE-2010-4306.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4191 
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4192, and CVE-2010-4306.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4192 
Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted 3D Assets 0xFFFFFF88 type record that triggers an incorrect memory allocation, a different vulnerability than CVE-2011-0555, CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4191, and CVE-2010-4306.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4193 
Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4194 
The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4195 
The TextXtra module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4196 
The Shockwave 3d Asset module in Adobe Shockwave Player before 11.5.9.620 does not properly validate unspecified input data, which allows attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T15:00:00.000Z
CVE-2010-4197 
Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving text editing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4198 
WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, does not properly handle large text areas, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4199 
Google Chrome before 7.0.517.44 does not properly perform a cast of an unspecified variable during processing of an SVG use element, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SVG document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4201 
Use-after-free vulnerability in Google Chrome before 7.0.517.44 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving text control selections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4202 
Multiple integer overflows in Google Chrome before 7.0.517.44 on Linux allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted font.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4203 
WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4204 
WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, accesses a frame object after this object has been destroyed, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4205 
Google Chrome before 7.0.517.44 does not properly handle the data types of event objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4206 
Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SVG document, related to effects in the application of filters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-4207 
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-07T21:00:00.000Z
CVE-2010-4208 
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.5.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to uploader/assets/uploader.swf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-07T21:00:00.000Z
CVE-2010-4209 
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.8.1, as used in Bugzilla 3.7.1 through 3.7.3 and 4.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to swfstore/swfstore.swf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-07T21:00:00.000Z
CVE-2010-4210 
The pfs_getextattr function in FreeBSD 7.x before 7.3-RELEASE and 8.x before 8.0-RC1 unlocks a mutex that was not previously locked, which allows local users to cause a denial of service (kernel panic), overwrite arbitrary memory locations, and possibly execute arbitrary code via vectors related to opening a file on a file system that uses pseudofs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-20T20:00:00.000Z
CVE-2010-4211 
The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-08T23:00:00.000Z
CVE-2010-4212 
The USAA application 3.0 for Android stores a mirror image of each visited web page, which might allow physically proximate attackers to obtain sensitive banking information by reading application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-08T23:00:00.000Z
CVE-2010-4213 
The Bank of America application 2.12 for Android stores a security question's answer in cleartext, which might allow physically proximate attackers to obtain sensitive information by reading application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-08T23:00:00.000Z
CVE-2010-4214 
The Wells Fargo Mobile application 1.1 for Android stores a username and password, along with account balances, in cleartext, which might allow physically proximate attackers to obtain sensitive information by reading application data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-08T23:00:00.000Z
CVE-2010-4215 
UI/Manage.pm in Foswiki 1.1.0 and 1.1.1 allows remote authenticated users to gain privileges by modifying the GROUP and ALLOWTOPICCHANGE preferences in the topic preferences for Main.AdminGroup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-16T23:00:00.000Z
CVE-2010-4216 
IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 does not properly handle invalid buffer references in LDAP BER requests, which might allow remote attackers to cause a denial of service (daemon crash) via vectors involving a buffer that has a memory address near the maximum possible address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2010-4217 
Use-after-free vulnerability in the proxy server in IBM Tivoli Directory Server (TDS) 6.0.0.x before 6.0.0.8-TIV-ITDS-IF0007 and 6.1.x before 6.1.0-TIV-ITDS-FP0005 allows remote attackers to cause a denial of service (daemon crash) via an unbind request that occurs during a certain search operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2010-4218 
Unspecified vulnerability in Web Services in IBM ENOVIA 6 has unknown impact and attack vectors, related to a system that becomes "exposed to the internet."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2010-4219 
Cross-site scripting (XSS) vulnerability in SemanticTagService.js in IBM WebSphere Portal 6.1.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2010-4220 
Cross-site scripting (XSS) vulnerability in the Integrated Solution Console in the Administrative Console component in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related in part to "URL injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2010-4221 
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2010-4225 
Unspecified vulnerability in the mod_mono module for XSP in Mono 2.8.x before 2.8.2 allows remote attackers to obtain the source code for .aspx (ASP.NET) applications via unknown vectors related to an "unloading bug."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-11T01:00:00.000Z
CVE-2010-4226 
cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symlink within an RPM package archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-06T16:00:00.000Z
CVE-2010-4227 
The xdrDecodeString function in XNFS.NLM in Novell Netware 6.5 before SP8 allows remote attackers to cause a denial of service (abend) or execute arbitrary code via a crafted, signed value in a NFS RPC request to port UDP 1234, leading to a stack-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-25T18:00:00.000Z
CVE-2010-4228 
Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2010-4229 
Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks Configuration Management 10.3 before 10.3.2, and 11, allows remote attackers to overwrite files, and subsequently execute arbitrary code, via directory traversal sequences in a filename field in an upload request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-18T18:00:00.000Z
CVE-2010-4230 
Stack-based buffer overflow in a certain ActiveX control for the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to execute arbitrary code via a long string in the first argument to the connect method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-16T23:00:00.000Z
CVE-2010-4231 
Directory traversal vulnerability in the web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-16T23:00:00.000Z
CVE-2010-4232 
The web-based administration interface on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to bypass authentication via a // (slash slash) at the beginning of a URI, as demonstrated by the //system.html URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-16T23:00:00.000Z
CVE-2010-4233 
The Linux installation on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 has a default password of m for the root account, and a default password of merlin for the mg3500 account, which makes it easier for remote attackers to obtain access via the TELNET interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-16T23:00:00.000Z
CVE-2010-4234 
The web server on the Camtron CMNC-200 Full HD IP Camera and TecVoz CMNC-200 Megapixel IP Camera with firmware 1.102A-008 allows remote attackers to cause a denial of service (device reboot) via a large number of requests in a short time interval.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-16T23:00:00.000Z
CVE-2010-4235 
Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server 12.x, 13.x, and 14.x before 14.2, allows remote attackers to execute arbitrary code via vectors related to the x-wap-profile HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-01T21:00:00.000Z
CVE-2010-4236 
Untrusted search path vulnerability in estaskwrapper in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges via an ES_LIBRARY_PATH environment variable and a modified PATH environment variable, which is used during execution of the estasklight program, a different vulnerability than CVE-2010-3895.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-4237 
Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.
Problem types: description: Other
Affected products: vendor: mercurial
product: mercurial
Published: 2019-10-29T17:07:34.000Z
CVE-2010-4238 
The vbd_create function in Xen 3.1.2, when the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 is used, allows guest OS users to cause a denial of service (host OS panic) via an attempted access to a virtual CD-ROM device through the blkback driver.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-22T21:00:00.000Z
CVE-2010-4239 
Tiki Wiki CMS Groupware 5.2 has Local File Inclusion
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: Tiki Wiki
product: CMS Groupware
Published: 2019-10-28T14:48:29.000Z
CVE-2010-4240 
Tiki Wiki CMS Groupware 5.2 has XSS
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: Tiki Wiki
product: CMS Groupware
Published: 2019-10-28T14:45:55.000Z
CVE-2010-4241 
Tiki Wiki CMS Groupware 5.2 has CSRF
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: Tiki Wiki
product: CMS Groupware
Published: 2019-10-28T14:43:05.000Z
CVE-2010-4242 
The hci_uart_tty_open function in the HCI UART driver (drivers/bluetooth/hci_ldisc.c) in the Linux kernel 2.6.36, and possibly other versions, does not verify whether the tty has a write operation, which allows local users to cause a denial of service (NULL pointer dereference) via vectors related to the Bluetooth driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-11T01:00:00.000Z
CVE-2010-4243 
fs/exec.c in the Linux kernel before 2.6.37 does not enable the OOM Killer to assess use of stack memory by arrays representing the (1) arguments and (2) environment, which allows local users to cause a denial of service (memory consumption) via a crafted exec system call, aka an "OOM dodging issue," a related issue to CVE-2010-3858.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-22T21:00:00.000Z
CVE-2010-4245 
pootle 2.0.5 has XSS via 'match_names' parameter
Problem types: description: XSS via 'match_names' parameter on translate.html page
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T14:33:05.000Z
CVE-2010-4246 
Multiple cross-site scripting (XSS) vulnerabilities in graph.php in pfSense 1.2.3 and 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via the (1) ifnum or (2) ifname parameter, a different vulnerability than CVE-2008-1182.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-07T01:00:00.000Z
CVE-2010-4247 
The do_block_io_op function in (1) drivers/xen/blkback/blkback.c and (2) drivers/xen/blktap/blktap.c in Xen before 3.4.0 for the Linux kernel 2.6.18, and possibly other versions, allows guest OS users to cause a denial of service (infinite loop and CPU consumption) via a large production request index to the blkback or blktap back-end drivers.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-11T01:00:00.000Z
CVE-2010-4248 
Race condition in the __exit_signal function in kernel/exit.c in the Linux kernel before 2.6.37-rc2 allows local users to cause a denial of service via vectors related to multithreaded exec, the use of a thread group leader in kernel/posix-cpu-timers.c, and the selection of a new thread group leader in the de_thread function in fs/exec.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-30T21:19:00.000Z
CVE-2010-4249 
The wait_for_unix_gc function in net/unix/garbage.c in the Linux kernel before 2.6.37-rc3-next-20101125 does not properly select times for garbage collection of inflight sockets, which allows local users to cause a denial of service (system hang) via crafted use of the socketpair and sendmsg system calls for SOCK_SEQPACKET sockets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-29T15:00:00.000Z
CVE-2010-4250 
Memory leak in the inotify_init1 function in fs/notify/inotify/inotify_user.c in the Linux kernel before 2.6.37 allows local users to cause a denial of service (memory consumption) via vectors involving failed attempts to create files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2010-4251 
The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-26T16:00:00.000Z