rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4112 
The net subsystem in the Linux kernel before 3.1 does not properly restrict use of the IFF_TX_SKB_SHARING flag, which allows local users to cause a denial of service (panic) by leveraging the CAP_NET_ADMIN capability to access /proc/net/pktgen/pgctrl, and then using the pktgen package in conjunction with a bridge device for a VLAN interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-4113 
SQL injection vulnerability in the Views module before 6.x-2.13 for Drupal allows remote attackers to execute arbitrary SQL commands via vectors related to "filters/arguments on certain types of views with specific configurations of arguments."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-17T23:00:00.000Z
CVE-2011-4114 
The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program.  NOTE: a similar vulnerability was reported for PAR, but this has been assigned a different CVE identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-13T18:00:00.000Z
CVE-2011-4115 
Parallel::ForkManager module before 1.0.0 for Perl does not properly handle temporary files.
Problem types: description: Other
Affected products: vendor: Parallel::ForkManager
product: Parallel::ForkManager
Published: 2020-01-31T17:12:44.000Z
CVE-2011-4116 
_is_safe in the File::Temp module for Perl does not properly handle symlinks.
Problem types: description: Other
Affected products: vendor: File::Temp
product: File::Temp
Published: 2020-01-31T17:12:40.000Z
CVE-2011-4117 
The Batch::BatchRun module 1.03 for Perl does not properly handle temporary files.
Problem types: description: Other
Affected products: vendor: Batch::BatchRun
product: Batch::BatchRun
Published: 2020-01-31T17:12:36.000Z
CVE-2011-4118 
Mahara before 1.4.1, when MNet (aka the Moodle network feature) is used, allows remote authenticated users to gain privileges via a jump to an XMLRPC target.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-15T02:00:00.000Z
CVE-2011-4119 
caml-light <= 0.75 uses mktemp() insecurely, and also does unsafe things in /tmp during make install.
Problem types: cwe_id: CWE-377
description: CWE-377
Affected products: vendor: n/a
product: caml-light
Published: 2021-10-26T12:11:15.000Z
CVE-2011-4120 
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.
Problem types: description: Other
Affected products: vendor: yubico-pam
product: yubico-pam
Published: 2019-11-26T04:17:52.000Z
CVE-2011-4121 
The OpenSSL extension of Ruby (Git trunk) versions after 2011-09-01 up to 2011-11-03 always generated an exponent value of '1' to be used for private RSA key generation. A remote attacker could use this flaw to bypass or corrupt integrity of services, depending on strong private RSA keys generation mechanism.
Problem types: description: Other
Affected products: vendor: OpenSSL
product: OpenSSL extension of Ruby (Git trunk)
Published: 2019-11-26T04:35:56.000Z
CVE-2011-4122 
Directory traversal vulnerability in openpam_configure.c in OpenPAM before r478 on FreeBSD 8.1 allows local users to load arbitrary DSOs and gain privileges via a .. (dot dot) in the service_name argument to the pam_start function, as demonstrated by a .. in the -c option to kcheckpass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-4124 
Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: n/a
product: Calibre
Published: 2021-10-27T00:50:04.000Z
CVE-2011-4125 
A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.
Problem types: cwe_id: CWE-426
description: CWE-426
Affected products: vendor: n/a
product: Calibre
Published: 2021-10-27T00:50:09.000Z
CVE-2011-4126 
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.
Problem types: cwe_id: CWE-367
description: CWE-367
Affected products: vendor: n/a
product: Calibre
Published: 2021-10-27T00:50:15.000Z
CVE-2011-4127 
The Linux kernel before 3.2.2 does not properly restrict SG_IO ioctl calls, which allows local users to bypass intended restrictions on disk read and write operations by sending a SCSI command to (1) a partition block device or (2) an LVM volume.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2011-4128 
Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T20:00:00.000Z
CVE-2011-4129 
(1) services/twitter/twitter-contact-view.c and (2) services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2011-4130 
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-06T11:00:00.000Z
CVE-2011-4131 
The NFSv4 implementation in the Linux kernel before 3.2.2 does not properly handle bitmap sizes in GETACL replies, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-4132 
The cleanup_journal_tail function in the Journaling Block Device (JBD) functionality in the Linux kernel 2.6 allows local users to cause a denial of service (assertion error and kernel oops) via an ext3 or ext4 image with an "invalid log first block value."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4133 
Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T10:00:00.000Z
CVE-2011-4134 
Heap-based buffer overflow in lmadmin in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allows remote attackers to execute arbitrary code via a crafted 0x2f packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T19:00:00.000Z
CVE-2011-4135 
Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files.  NOTE: this might overlap CVE-2011-1389.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T19:00:00.000Z
CVE-2011-4136 
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-19T10:00:00.000Z
CVE-2011-4137 
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-19T10:00:00.000Z
CVE-2011-4138 
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-19T10:00:00.000Z
CVE-2011-4139 
Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-19T10:00:00.000Z
CVE-2011-4140 
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-19T10:00:00.000Z
CVE-2011-4141 
Untrusted search path vulnerability in EMC RSA SecurID Software Token 4.1 before 4.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a Software Token file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-17T02:00:00.000Z
CVE-2011-4142 
The Web Search feature in EMC SourceOne Email Management 6.5 before 6.5.2.4033, 6.6 before 6.6.1.2194, and 6.7 before 6.7.2.2033 places cleartext credentials in log files, which allows local users to obtain sensitive information by reading these files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T11:00:00.000Z
CVE-2011-4143 
EMC RSA enVision 4.0 before SP4 P5 and 4.1 before P3 allows remote attackers to obtain sensitive information about environment variables in the web system via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T00:00:00.000Z
CVE-2011-4144 
Unspecified vulnerability in EMC Documentum Content Server 6.0, 6.5 before SP2 P02, 6.5 SP3 before SP3 P02, and 6.6 before P02 allows local users to obtain "highest super user privileges" by leveraging system administrator privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-02T02:00:00.000Z
CVE-2011-4151 
The krb5_db2_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4, when the db2 (aka Berkeley DB) back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, a different vulnerability than CVE-2011-1528.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-20T21:00:00.000Z
CVE-2011-4153 
PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that performs strndup operations on untrusted string data, as demonstrated by the define function in zend_builtin_functions.c, and unspecified functions in ext/soap/php_sdl.c, ext/standard/syslog.c, ext/standard/browscap.c, ext/oci8/oci8.c, ext/com_dotnet/com_typeinfo.c, and main/php_open_temporary_file.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-18T20:00:00.000Z
CVE-2011-4155 
Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4156.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-16T22:00:00.000Z
CVE-2011-4156 
Cross-site scripting (XSS) vulnerability in HP Network Node Manager i (NNMi) 9.0x and 9.1x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2011-4155.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-16T22:00:00.000Z
CVE-2011-4157 
Stack-based buffer overflow in hydra.exe in HP SAN/iQ before 9.5 on the HP StorageWorks P4000 Virtual SAN Appliance allows remote attackers to execute arbitrary code via a crafted login request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-16T16:00:00.000Z
CVE-2011-4158 
Unspecified vulnerability in HP Directories Support for ProLiant Management Processors 3.10 and 3.20 for Integrated Lights-Out iLO2 and iLO3 allows remote authenticated users to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-16T16:00:00.000Z
CVE-2011-4159 
Unspecified vulnerability in System Administration Manager (SAM) in EMS before A.04.20.11.04_01 on HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-19T02:00:00.000Z
CVE-2011-4160 
Unspecified vulnerability in HP Operations Agent 11.00 and Performance Agent 4.73 and 5.0 on AIX, HP-UX, Linux, and Solaris allows local users to bypass intended directory-access restrictions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-24T02:00:00.000Z
CVE-2011-4161 
The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-01T21:00:00.000Z
CVE-2011-4162 
The (1) AddUser, (2) AddUserEx, (3) RemoveUser, (4) RemoveUserByGuide, (5) RemoveUserEx, and (6) RemoveUserRegardless methods in HP Protect Tools Device Access Manager (PTDAM) before 6.1.0.1 allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a long SidString argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-05T11:00:00.000Z
CVE-2011-4163 
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1213.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-29T19:00:00.000Z
CVE-2011-4164 
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1214.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-29T19:00:00.000Z
CVE-2011-4165 
Unspecified vulnerability in HP Database Archiving Software 6.31 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1263.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-29T19:00:00.000Z
CVE-2011-4166 
Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T02:00:00.000Z
CVE-2011-4167 
Stack-based buffer overflow in MPAUploader.dll in HP Managed Printing Administration before 2.6.4 allows remote attackers to execute arbitrary code via a long filename parameter in an uploadfile action to Default.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T02:00:00.000Z
CVE-2011-4168 
Directory traversal vulnerability in hpmpa/jobDelivery/Default.asp in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T02:00:00.000Z
CVE-2011-4169 
Unspecified vulnerability in HP Managed Printing Administration before 2.6.4 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T02:00:00.000Z
CVE-2011-4170 
Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname) in a /me event, a different vulnerability than CVE-2011-3635.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-23T10:00:00.000Z
CVE-2011-4171 
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the project parameter to teamserver/faces/home.jsp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-24T18:00:00.000Z
CVE-2011-4172 
Multiple cross-site scripting (XSS) vulnerabilities in KENT-WEB WEB FORUM before 5.1 allow remote attackers to inject arbitrary web script or HTML via (1) an e-mail address field or (2) a cookie, a related issue to CVE-2011-3383, CVE-2011-3983, and CVE-2011-3984.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-24T18:00:00.000Z
CVE-2011-4173 
Cross-site request forgery (CSRF) vulnerability in Simple Machines Forum (SMF) 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-24T18:00:00.000Z
CVE-2011-4181 open build service information leak via unauthorized source access
A vulnerability in open build service allows remote attackers to gain access to source files even though source access is disabled. Affected releases are SUSE open build service up to and including version 2.1.15 (for 2.1) and before version 2.3.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: SUSE
product: open build service
Published: 2018-06-11T15:00:00.000Z
CVE-2011-4182 shell code injection via ESSID because of missing escaping of a variable
Missing escaping of ESSID values in sysconfig of SUSE Linux Enterprise allows attackers controlling an access point to cause execute arbitrary code. Affected releases are sysconfig prior to 0.83.7-2.1.
Problem types: cwe_id: CWE-77
description: CWE-77
Affected products: vendor: SUSE Linux Enterprise
product: sysconfig
Published: 2018-06-12T15:00:00.000Z
CVE-2011-4183 open build service allows anyone to upload rpms
A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.
Problem types: cwe_id: CWE-862
description: CWE-862
Affected products: vendor: SUSE
product: open build service
Published: 2018-06-13T13:00:00.000Z
CVE-2011-4185 
The GetPrinterURLList2 method in the ActiveX control in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2008-2431 and CVE-2008-2436.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-20T21:00:00.000Z
CVE-2011-4186 
Heap-based buffer overflow in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a crafted client-file-name parameter in a printer-url, a different vulnerability than CVE-2011-1705.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-20T21:00:00.000Z
CVE-2011-4187 
Buffer overflow in the GetDriverSettings function in nipplib.dll in Novell iPrint Client before 5.78 on Windows allows remote attackers to execute arbitrary code via a long realm field, a different vulnerability than CVE-2011-3173.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-20T21:00:00.000Z
CVE-2011-4188 
Buffer overflow in the Create Attribute function in jclient in Novell iManager 2.7.4 before patch 4 allows remote authenticated users to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted EnteredAttrName parameter, a related issue to CVE-2010-1929.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-09T20:00:00.000Z
CVE-2011-4189 
The client in Novell GroupWise 8.0x through 8.02HP3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via a long e-mail address in an Address Book (aka .NAB) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-02T22:00:00.000Z
CVE-2011-4190 Missing verification of host key for kdump server
The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files).
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: SUSE
product: kdump
Credits: lang: en
value: Kevan Carstensen
Published: 2018-06-08T17:00:00.000Z
CVE-2011-4191 
Stack-based buffer overflow in the xdrDecodeString function in XNFS.NLM in Novell NetWare 6.5 SP8 allows remote attackers to execute arbitrary code or cause a denial of service (abend or NFS outage) via long packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T02:00:00.000Z