rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-2460 
Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2459.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-11T16:00:00.000Z
CVE-2011-2461 
Cross-site scripting (XSS) vulnerability in the Adobe Flex SDK 3.x and 4.x before 4.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to the loading of modules from different domains.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-01T11:00:00.000Z
CVE-2011-2462 
Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, as exploited in the wild in December 2011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-2463 
Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 8.0 through 9.0.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving the cfform tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T11:00:00.000Z
CVE-2011-2464 
Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-08T20:00:00.000Z
CVE-2011-2465 
Unspecified vulnerability in ISC BIND 9 9.8.0, 9.8.0-P1, 9.8.0-P2, and 9.8.1b1, when recursion is enabled and the Response Policy Zone (RPZ) contains DNAME or certain CNAME records, allows remote attackers to cause a denial of service (named daemon crash) via an unspecified query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-08T20:00:00.000Z
CVE-2011-2467 
SQL injection vulnerability in lsassd in Lsass in the Likewise Security Authority in Likewise Open 5.4 through 6.1, and Likewise Enterprise 6.0, allows local users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T01:29:00.000Z
CVE-2011-2468 
Directory traversal vulnerability in the web interface in AnyMacro Mail System G4X allows remote attackers to read arbitrary files via directory traversal sequences in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-07T19:00:00.000Z
CVE-2011-2470 
Cross-site scripting (XSS) vulnerability in chat/base/admin/login.php in A Really Simple Chat (ARSC) 3.3-rc2 allows remote attackers to inject arbitrary web script or HTML via the arsc_message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-29T17:00:00.000Z
CVE-2011-2471 
utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to gain privileges via shell metacharacters in the (1) --vmlinux, (2) --session-dir, or (3) --xen argument, related to the daemonrc file and the do_save_setup and do_load_setup functions, a different vulnerability than CVE-2011-1760.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-09T21:00:00.000Z
CVE-2011-2472 
Directory traversal vulnerability in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to overwrite arbitrary files via a .. (dot dot) in the --save argument, related to the --session-dir argument, a different vulnerability than CVE-2011-1760.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-09T21:00:00.000Z
CVE-2011-2473 
The do_dump_data function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to create or overwrite arbitrary files via a crafted --session-dir argument in conjunction with a symlink attack on the opd_pipe file, a different vulnerability than CVE-2011-1760.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-09T21:00:00.000Z
CVE-2011-2474 
Directory traversal vulnerability in the HTTP Server in Sybase EAServer 6.3.1 Developer Edition allows remote attackers to read arbitrary files via a /.\../\../\ sequence in a path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-09T21:00:00.000Z
CVE-2011-2475 
Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server and DMZ Proxy in Sybase OneBridge Mobile Data Suite 5.5 and 5.6 allows remote attackers to execute arbitrary code via format string specifiers in unspecified string fields, related to authentication logging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-09T21:00:00.000Z
CVE-2011-2476 
Cross-site scripting (XSS) vulnerability in Coppermine Photo Gallery (CPG) before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-4667.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-14T17:00:00.000Z
CVE-2011-2477 
Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escape_html_tags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a check-host-alive! sequence, a different vulnerability than CVE-2011-2179.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-14T17:00:00.000Z
CVE-2011-2478 
Google SketchUp before 8 does not properly handle edge geometry in SketchUp (aka .SKP) files, which allows remote attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-17T18:00:00.000Z
CVE-2011-2479 
The Linux kernel before 2.6.39 does not properly create transparent huge pages in response to a MAP_PRIVATE mmap system call on /dev/zero, which allows local users to cause a denial of service (system crash) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T11:00:00.000Z
CVE-2011-2480 
Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information.
Problem types: description: info disclosure
Affected products: vendor: FreeBSD, NetBSD
product: FreeBSD
vendor: FreeBSD, NetBSD
product: NetBSD
Published: 2019-11-27T18:53:37.000Z
CVE-2011-2481 
Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.  NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-15T21:00:00.000Z
CVE-2011-2482 
A certain Red Hat patch to the sctp_sock_migrate function in net/sctp/socket.c in the Linux kernel before 2.6.21, as used in Red Hat Enterprise Linux (RHEL) 5, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted SCTP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-2483 
crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-25T14:00:00.000Z
CVE-2011-2484 
The add_del_listener function in kernel/taskstats.c in the Linux kernel 2.6.39.1 and earlier does not prevent multiple registrations of exit handlers, which allows local users to cause a denial of service (memory and CPU consumption), and bypass the OOM Killer, via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-24T20:00:00.000Z
CVE-2011-2485 
The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, which allows remote attackers to cause a denial of service (memory consumption) via a crafted GIF image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2011-2486 
nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as demonstrated using Flash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-19T11:00:00.000Z
CVE-2011-2487 
The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
Problem types: description: Other
Affected products: vendor: Apache
product: WSS4J
vendor: Red Hat
product: JBossWS
Published: 2020-03-11T15:45:46.000Z
CVE-2011-2488 
Joomla! before 1.5.23 does not properly check for errors, which allows remote attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T20:00:00.000Z
CVE-2011-2489 
Multiple off-by-one errors in opiesu.c in opiesu in OPIE 2.4.1-test1 and earlier might allow local users to gain privileges via a crafted command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T01:29:00.000Z
CVE-2011-2490 
opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T01:29:00.000Z
CVE-2011-2491 
The Network Lock Manager (NLM) protocol implementation in the NFS client functionality in the Linux kernel before 3.0 allows local users to cause a denial of service (system hang) via a LOCK_UN flock system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T11:00:00.000Z
CVE-2011-2492 
The bluetooth subsystem in the Linux kernel before 3.0-rc4 does not properly initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel memory via a crafted getsockopt system call, related to (1) the l2cap_sock_getsockopt_old function in net/bluetooth/l2cap_sock.c and (2) the rfcomm_sock_getsockopt_old function in net/bluetooth/rfcomm/sock.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-28T22:00:00.000Z
CVE-2011-2493 
The ext4_fill_super function in fs/ext4/super.c in the Linux kernel before 2.6.39 does not properly initialize a certain error-report data structure, which allows local users to cause a denial of service (OOPS) by attempting to mount a crafted ext4 filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-13T10:00:00.000Z
CVE-2011-2494 
kernel/taskstats.c in the Linux kernel before 3.1 allows local users to obtain sensitive I/O statistics by sending taskstats commands to a netlink socket, as demonstrated by discovering the length of another user's password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-13T10:00:00.000Z
CVE-2011-2495 
fs/proc/base.c in the Linux kernel before 2.6.39.4 does not properly restrict access to /proc/#####/io files, which allows local users to obtain sensitive I/O statistics by polling a file, as demonstrated by discovering the length of another user's password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-13T10:00:00.000Z
CVE-2011-2496 
Integer overflow in the vma_to_resize function in mm/mremap.c in the Linux kernel before 2.6.39 allows local users to cause a denial of service (BUG_ON and system crash) via a crafted mremap system call that expands a memory mapping.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-13T10:00:00.000Z
CVE-2011-2497 
Integer underflow in the l2cap_config_req function in net/bluetooth/l2cap_core.c in the Linux kernel before 3.0 allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a small command-size value within the command header of a Logical Link Control and Adaptation Protocol (L2CAP) configuration request, leading to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T18:00:00.000Z
CVE-2011-2498 
The Linux kernel from v2.3.36 before v2.6.39 allows local unprivileged users to cause a denial of service (memory consumption) by triggering creation of PTE pages.
Problem types: description: Other
Affected products: vendor: n/a
product: Linux kernel
Published: 2020-02-20T03:59:37.000Z
CVE-2011-2499 
Mambo CMS through 4.6.5 has multiple XSS.
Problem types: description: XSS
Affected products: vendor: Mambo
product: CMS
Published: 2020-02-12T19:09:15.000Z
CVE-2011-2500 
The host_reliable_addrinfo function in support/export/hostname.c in nfs-utils before 1.2.4 does not properly use DNS to verify access to NFS exports, which allows remote attackers to mount filesystems by establishing crafted DNS A and PTR records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-15T11:00:00.000Z
CVE-2011-2501 
The png_format_buffer function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 allows remote attackers to cause a denial of service (application crash) via a crafted PNG image that triggers an out-of-bounds read during the copying of error-message data.  NOTE: this vulnerability exists because of a CVE-2004-0421 regression. NOTE: this is called an off-by-one error by some sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2502 
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T19:00:00.000Z
CVE-2011-2503 
The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T19:00:00.000Z
CVE-2011-2504 
Untrusted search path vulnerability in x11perfcomp in XFree86 x11perf before 1.5.4 allows local users to gain privileges via unspecified Trojan horse code in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-08T22:00:00.000Z
CVE-2011-2505 
libraries/auth/swekey/swekey.auth.lib.php in the Swekey authentication feature in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 assigns values to arbitrary parameters referenced in the query string, which allows remote attackers to modify the SESSION superglobal array via a crafted request, related to a "remote variable manipulation vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-14T23:00:00.000Z
CVE-2011-2506 
setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters, which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-14T23:00:00.000Z
CVE-2011-2507 
libraries/server_synchronize.lib.php in the Synchronize implementation in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly quote regular expressions, which allows remote authenticated users to inject a PCRE e (aka PREG_REPLACE_EVAL) modifier, and consequently execute arbitrary PHP code, by leveraging the ability to modify the SESSION superglobal array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-14T23:00:00.000Z
CVE-2011-2508 
Directory traversal vulnerability in libraries/display_tbl.lib.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1, when a certain MIME transformation feature is enabled, allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in a GLOBALS[mime_map][$meta->name][transformation] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-14T23:00:00.000Z
CVE-2011-2509 
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component, as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component, as demonstrated by the filter_order parameter to index.php; (3) the query string to the com_newsfeeds component, as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and, when Internet Explorer or Konqueror is used, (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T20:00:00.000Z
CVE-2011-2510 
Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web script or HTML via a link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-14T23:00:00.000Z
CVE-2011-2511 
Integer overflow in libvirt before 0.9.3 allows remote authenticated users to cause a denial of service (libvirtd crash) and possibly execute arbitrary code via a crafted VirDomainGetVcpus RPC call that triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-10T20:00:00.000Z
CVE-2011-2512 
The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2011-2513 
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2011-2514 
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-14T00:00:00.000Z
CVE-2011-2515 
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.
Problem types: description: installs unsigned RPM packages as though they were signed
Affected products: vendor: packagekit
product: packagekit
Published: 2019-11-27T20:18:50.000Z
CVE-2011-2516 
Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-11T20:00:00.000Z
CVE-2011-2517 
Multiple buffer overflows in net/wireless/nl80211.c in the Linux kernel before 2.6.39.2 allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability during scan operations with a long SSID value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-2518 
The tomoyo_mount_acl function in security/tomoyo/mount.c in the Linux kernel before 2.6.39.2 calls the kern_path function with arguments taken directly from a mount system call, which allows local users to cause a denial of service (OOPS) or possibly have unspecified other impact via a NULL value for the device name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-2519 
Xen in the Linux kernel, when running a guest on a host without hardware assisted paging (HAP), allows guest users to cause a denial of service (invalid pointer dereference and hypervisor crash) via the SAHF instruction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-12-27T01:00:00.000Z
CVE-2011-2520 
fw_dbus.py in system-config-firewall 1.2.29 and earlier uses the pickle Python module unsafely during D-Bus communication between the GUI and the backend, which might allow local users to gain privileges via a crafted serialized object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-21T23:00:00.000Z
CVE-2011-2521 
The x86_assign_hw_event function in arch/x86/kernel/cpu/perf_event.c in the Performance Events subsystem in the Linux kernel before 2.6.39 does not properly calculate counter values, which allows local users to cause a denial of service (panic) via the perf program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z