rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-2070 
Cross-site scripting (XSS) vulnerability in the MultiBlock module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer blocks permission to inject arbitrary web script or HTML via the block title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2071 
Cross-site scripting (XSS) vulnerability in the Contact Forms module 6.x-1.x before 6.x-1.13 for Drupal when the core contact form is enabled, allows remote authenticated users with the administer site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2072 
Cross-site scripting (XSS) vulnerability in the Share Buttons (AddToAny) module 6.x-3.x before 6.x-3.4 for Drupal allows remote authenticated users with the administer addtoany permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2073 
The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2074 
Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2075 
Cross-site scripting (XSS) vulnerability in the Contact Save module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the access site-wide contact form permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2076 
Cross-site scripting (XSS) vulnerability in the administration forms in the ShareThis module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with administer sharethis permissions to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2077 
Cross-site request forgery (CSRF) vulnerability in the ShareThis module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of users with administer sharethis permissions via unknown vectors "outside of the Form API."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2078 
Cross-site scripting (XSS) vulnerability in the Activity module 6.x-1.x for Drupal.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Activity
product: Activity
Published: 2019-11-21T22:58:01.000Z
CVE-2012-2079 
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Activity
product: Activity
Published: 2019-11-21T23:02:39.000Z
CVE-2012-2080 
Cross-site request forgery (CSRF) vulnerability in the Node Limit Number module before 6.x-1.2 for Drupal allows remote attackers to hijack the authentication of users with the administer node limitnumber permission for requests that delete limits.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2081 
The Organic Groups (OG) module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2082 
Cross-site scripting (XSS) vulnerability in the Chaos tool suite (aka CTools) module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the post comments permission to inject arbitrary web script or HTML via a user signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T23:00:00.000Z
CVE-2012-2083 
Cross-site scripting (XSS) vulnerability in the fusion_core_preprocess_page function in fusion_core/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T22:00:00.000Z
CVE-2012-2084 
Cross-site scripting (XSS) vulnerability in the Printer, email and PDF versions module 6.x-1.x before 6.x-1.15 and 7.x-1.x before 7.x-1.0 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-22T11:00:00.000Z
CVE-2012-2085 
The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-28T16:00:00.000Z
CVE-2012-2086 
SQL injection vulnerability in the get_last_conversation_lines function in common/logger.py in Gajim before 0.15 allows remote attackers to execute arbitrary SQL commands via the jig parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-2087 
ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface.
Problem types: description: authentication error
Affected products: vendor: ISPConfig
product: ISPConfig
Published: 2020-01-23T13:57:47.000Z
CVE-2012-2088 
Integer signedness error in the TIFFReadDirectory function in tif_dirread.c in libtiff 3.9.4 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a negative tile depth in a tiff image, which triggers an improper conversion between signed and unsigned types, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T17:00:00.000Z
CVE-2012-2089 
Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-17T21:00:00.000Z
CVE-2012-2090 
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2091 
Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long string in a rotor tag of an aircraft xml model to the Rotor::getValueforFGSet function in src/FDM/YASim/Rotor.cpp or (2) a crafted UDP packet to the SGSocketUDP::read function in simgear/simgear/simgear/io/sg_socket_udp.cxx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-17T01:00:00.000Z
CVE-2012-2092 
A Security Bypass vulnerability exists in Ubuntu Cobbler before 2,2,2 in the cobbler-ubuntu-import script due to an error when verifying the GPG signature.
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: Ubuntu
product: Cobbler
Published: 2019-12-06T16:19:06.000Z
CVE-2012-2093 
src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-18T22:00:00.000Z
CVE-2012-2094 
Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-05T22:00:00.000Z
CVE-2012-2095 
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-07T15:00:00.000Z
CVE-2012-2096 
The Fivestar module 6.x-1.x before 6.x-1.20 for Drupal does not properly validate voting data, which allows remote attackers to manipulate voting averages via a negative value in the vote parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T21:00:00.000Z
CVE-2012-2097 
Cross-site request forgery (CSRF) vulnerability in the Autosave module 6.x before 6.x-2.10 and 7.x-2.x before 7.x-2.0 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests involving "submitting saved results to a node."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-14T21:00:00.000Z
CVE-2012-2098 
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-29T00:00:00.000Z
CVE-2012-2099 
Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) search field, or the (2) Author or (3) select_sort parameters in an advanced search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-24T01:00:00.000Z
CVE-2012-2100 
The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2012-2101 
Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service (CPU and hard drive consumption) via a network request that triggers a large number of iptables rules.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-07T19:00:00.000Z
CVE-2012-2102 
MySQL 5.1.x before 5.1.62 and 5.5.x before 5.5.22 allows remote authenticated users to cause a denial of service (assertion failure and mysqld abort) by deleting a record and using HANDLER READ NEXT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T00:00:00.000Z
CVE-2012-2103 
The qmailscan plugin for Munin 1.4.5 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T21:00:00.000Z
CVE-2012-2104 
cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T21:00:00.000Z
CVE-2012-2105 
Multiple SQL injection vulnerabilities in login.php in Timesheet Next Gen 1.5.2 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T19:00:00.000Z
CVE-2012-2106 
Integer overflow in the pv_import function in util/pv_import.c in Csound 5.16.6, when converting a file, allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-04T18:00:00.000Z
CVE-2012-2107 
Integer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-04T18:00:00.000Z
CVE-2012-2108 
Stack-based buffer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-04T18:00:00.000Z
CVE-2012-2109 
SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activity_widget_filter action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-04T20:00:00.000Z
CVE-2012-2110 
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-19T17:00:00.000Z
CVE-2012-2111 
The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-30T14:00:00.000Z
CVE-2012-2112 
Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8, and 4.7 allows remote attackers to inject arbitrary web script or HTML via exception messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T21:00:00.000Z
CVE-2012-2113 
Multiple integer overflows in tiff2pdf in libtiff before 4.0.2 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T17:00:00.000Z
CVE-2012-2114 
Stack-based buffer overflow in fprintf in musl before 0.8.8 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string to an unbuffered stream such as stderr.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T22:00:00.000Z
CVE-2012-2115 
SQL injection vulnerability in interface/login/validateUser.php in OpenEMR 4.1.0 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the u parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-09T21:00:00.000Z
CVE-2012-2116 
Cross-site request forgery (CSRF) vulnerability in the Commerce Reorder module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that add items to the shopping cart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T22:00:00.000Z
CVE-2012-2117 
Cross-site scripting (XSS) vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T22:00:00.000Z
CVE-2012-2118 
Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-18T22:00:00.000Z
CVE-2012-2119 
Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-22T23:00:00.000Z
CVE-2012-2120 
latex2man in texlive-extra-utils 2011.20120322, and possibly other versions or packages, when used with the H or T option, allows local users to overwrite arbitrary files via a symlink attack on a temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-18T22:00:00.000Z
CVE-2012-2121 
The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2012-2122 
sql/password.c in Oracle MySQL 5.1.x before 5.1.63, 5.5.x before 5.5.24, and 5.6.x before 5.6.6, and MariaDB 5.1.x before 5.1.62, 5.2.x before 5.2.12, 5.3.x before 5.3.6, and 5.5.x before 5.5.23, when running in certain environments with certain implementations of the memcmp function, allows remote attackers to bypass authentication by repeatedly authenticating with the same incorrect password, which eventually causes a token comparison to succeed due to an improperly-checked return value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-26T18:00:00.000Z
CVE-2012-2123 
The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2012-2124 
functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise Linux (RHEL) 4 and 5, does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preference files.  NOTE: this issue exists because of an incorrect fix for CVE-2010-2813.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-18T11:00:00.000Z
CVE-2012-2125 
RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T17:00:00.000Z
CVE-2012-2126 
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T17:00:00.000Z
CVE-2012-2127 
fs/proc/root.c in the procfs implementation in the Linux kernel before 3.2 does not properly interact with CLONE_NEWPID clone system calls, which allows remote attackers to cause a denial of service (reference leak and memory consumption) by making many connections to a daemon that uses PID namespaces to isolate clients, as demonstrated by vsftpd.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2012-2128 
Cross-site request forgery (CSRF) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users. NOTE: this issue has been disputed by the vendor, who states that it is resultant from CVE-2012-2129: "the exploit code simply uses the XSS hole to extract a valid CSRF token."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T00:00:00.000Z
CVE-2012-2129 
Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T21:00:00.000Z
CVE-2012-2130 
A Security Bypass vulnerability exists in PolarSSL 0.99pre4 through 1.1.1 due to a weak encryption error when generating Diffie-Hellman values and RSA keys.
Problem types: description: weak key generation in 0.99pre4 throught to 1.1.1
Affected products: vendor: polarssl
product: polarssl
Published: 2019-12-06T17:13:26.000Z
CVE-2012-2131 
Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-24T20:00:00.000Z
CVE-2012-2132 
libsoup 2.32.2 and earlier does not validate certificates or clear the trust flag when the ssl-ca-file does not exist, which allows remote attackers to bypass authentication by connecting with a SSL connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T18:00:00.000Z