rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-5033 
Stack-based buffer overflow in CFS.c in ConfigServer Security & Firewall (CSF) before 5.43, when running on a DirectAdmin server, allows local users to cause a denial of service (crash) via a long string in an admin.list file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-29T22:00:00.000Z
CVE-2011-5034 
Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.  NOTE: this might overlap CVE-2011-4461.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-5035 
Oracle Glassfish 2.1.1, 3.0.1, and 3.1.1, as used in Communications Server 2.0, Sun Java System Application Server 8.1 and 8.2, and possibly other products, computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka Oracle security ticket S0104869.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-5036 
Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-5037 
Google V8 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, as demonstrated by attacks against Node.js.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-5038 
SQL injection vulnerability in hitCode hitAppoint 4.5.17 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the username parameter to index.php.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5039 
Multiple SQL injection vulnerabilities in Infoproject Biznis Heroj allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters to login.php, (3) the filter parameter to widget.dokumenti_lista.php, and (4) the fin_nalog_id parameter to nalozi_naslov.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5040 
Multiple cross-site scripting (XSS) vulnerabilities in Infoproject Biznis Heroj allow remote attackers to inject arbitrary web script or HTML via the config parameter to (1) nalozi_naslov.php and (2) widget.dokumenti_lista.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5041 
Multiple cross-site scripting (XSS) vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary web script or HTML via the (1) d parameter in a blocks action and (2) post_id parameter in an edit-post action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5042 
Cross-site scripting (XSS) vulnerability in inc/lib/lib.base.php in SASHA 0.2.0 allows remote attackers to inject arbitrary web script or HTML via the instructors parameter.  NOTE: the original disclosure also mentions the section_title parameter, but this was disputed by the vendor and retracted by the original researcher.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5043 
TomatoSoft Free Mp3 Player 1.0 allows remote attackers to cause a denial of service (application crash) via a long string in an MP3 file, possibly a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5044 
SopCast 3.4.7.45585 uses weak permissions (Everyone:Full Control) for Diagnose.exe, which allows local users to execute arbitrary code by replacing Diagnose.exe with a Trojan horse program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5045 
Cross-site scripting (XSS) vulnerability in details_view.php in PHP Booking Calendar 10e allows remote attackers to inject arbitrary web script or HTML via the page_info_message parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5046 
The Graphics Device Interface (GDI) in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate user-mode input, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted data, as demonstrated by a large height attribute of an IFRAME element rendered by Safari, aka "GDI Access Violation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T19:00:00.000Z
CVE-2011-5047 
Cross-site scripting (XSS) vulnerability in status_rrd_graph.php in pfSense before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via the style parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-03T19:00:00.000Z
CVE-2011-5048 
Multiple cross-site scripting (XSS) vulnerabilities in IBM Web Experience Factory (aka WEF, formerly WebSphere Portlet Factory) 7.0 and 7.0.1 allow remote attackers to inject arbitrary web script or HTML via a (1) text INPUT element or (2) TEXTAREA element, related to an interaction between Smart Refresh and Dojo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-03T19:00:00.000Z
CVE-2011-5049 
MySQL 5.5.8, when running on Windows, allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted packet to TCP port 3306.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-04T19:00:00.000Z
CVE-2011-5050 
SQL injection vulnerability in corporate/Controller in Elitecore Technologies Cyberoam UTM before 10.01.2 build 059 allows remote authenticated administrators to execute arbitrary SQL commands via the tableid parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-04T19:00:00.000Z
CVE-2011-5051 
Multiple unrestricted file upload vulnerabilities in the WP Symposium plugin before 11.12.24 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension using (1) uploadify/upload_admin_avatar.php or (2) uploadify/upload_profile_avatar.php, then accessing it via a direct request to the file in an unspecified directory inside the webroot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-04T19:00:00.000Z
CVE-2011-5052 
Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-04T19:00:00.000Z
CVE-2011-5053 
The Wi-Fi Protected Setup (WPS) protocol, when the "external registrar" authentication method is used, does not properly inform clients about failed PIN authentication, which makes it easier for remote attackers to discover the PIN value, and consequently discover the Wi-Fi network password or reconfigure an access point, by reading EAP-NACK messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T20:00:00.000Z
CVE-2011-5054 
kcheckpass passes a user-supplied argument to the pam_start function, often within a setuid environment, which allows local users to invoke any configured PAM stack, and possibly trigger unintended side effects, via an arbitrary valid PAM service name, a different vulnerability than CVE-2011-4122.  NOTE: the vendor indicates that the possibility of resultant privilege escalation may be "a bit far-fetched."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T21:00:00.000Z
CVE-2011-5055 
MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set.  NOTE: this issue exists because of an incomplete fix for CVE-2012-0024.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T00:00:00.000Z
CVE-2011-5056 
The authoritative server in MaraDNS through 2.0.04 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which might allow local users to cause a denial of service (CPU consumption) via crafted records in zone files, a different vulnerability than CVE-2012-0024.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T00:00:00.000Z
CVE-2011-5057 
Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an "easy work-around in existing apps by configuring the interceptor."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T17:00:00.000Z
CVE-2011-5058 
The CmbWebserver.dll module of the Control service in 3S CoDeSys 3.4 SP4 Patch 2 allows remote attackers to create arbitrary directories under the web root by specifying a non-existent directory using \ (backslash) characters in an HTTP GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-10T23:00:00.000Z
CVE-2011-5059 
Stack-based buffer overflow in Final Draft 8 before 8.02 allows remote attackers to execute arbitrary code via a crafted SmartType element, a different vulnerability than CVE-2011-5002.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-10T23:00:00.000Z
CVE-2011-5060 
The par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program, a different vulnerability in a different package than CVE-2011-4114.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-13T19:00:00.000Z
CVE-2011-5061 
functions.php in WHMCompleteSolution (WHMCS) 4.0.x through 5.0.x allows remote attackers to trigger arbitrary code execution in the Smarty templating system by submitting a crafted ticket, related to improper handling of characters in the subject field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-14T02:00:00.000Z
CVE-2011-5062 
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-14T21:00:00.000Z
CVE-2011-5063 
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-14T21:00:00.000Z
CVE-2011-5064 
DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-14T21:00:00.000Z
CVE-2011-5065 
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 allows remote attackers to inject arbitrary web script or HTML via vectors related to web messaging.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-15T02:00:00.000Z
CVE-2011-5066 
The SibRaRecoverableSiXaResource class in the Default Messaging Component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 does not properly handle a Service Integration Bus (SIB) dump operation involving the First Failure Data Capture (FFDC) introspection code, which allows local users to obtain sensitive information by reading the FFDC log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-15T02:00:00.000Z
CVE-2011-5067 
move_uploaded_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-5068 
Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to hijack the authentication of user for requests that delete a user via user_delete.php and other unspecified programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-5069 
Unrestricted file upload vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in unspecified directory, a different program than CVE-2011-3833.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-5070 
Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php, possibly involving origref, linkref, linktype parameters, which are not properly handled in the clean_int function in lib/base.inc.php, or the redirect parameter, which is not properly handled in the html_redirect function in lib/html.inc.php; and (3) unspecified vectors in translate.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-5071 
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.64 allow remote attackers to execute arbitrary SQL commands via the (1) exc[] parameter to report_marketing.php, (2) selected[] parameter to tasks.php, (3) sites[] parameter to billable_incidents.php, or (4) search_string parameter to search.php. NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-5072 
Multiple SQL injection vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to execute arbitrary SQL commands via the (1) start parameter to portal/kb.php; (2) contractid parameter to contract_add_service.php; (3) id parameter to edit_escalation_path.php; (4) unlock, (5) lock, or (6) selected parameter to holding_queue.php; inc parameter in a report action to (7) report_customers.php or (8) report_incidents_by_site.php; (9) start parameter to search.php; or (10) sites parameter to transactions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T11:00:00.000Z
CVE-2011-5073 
Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to inject arbitrary web script or HTML via the (1) mode parameter to contact_support.php; (2) contractid parameter to contract_add_service.php; (3) user parameter to edit_backup_users.php; (4) id parameter to edit_escalation_path.php; the Referer to (5) forgotpwd.php, (6) an approvalpage action to billable_incidents.php, or (7) transactions.php; (8) action parameter to inbox.php; (9) search_string parameter in a findcontact action to incident_add.php; table1 parameter to (10) report_customers.php, (11) report_incidents_by_engineer.php, (12) report_incidents_by_site.php, or (13) report_marketing.php; or the (14) startdate or (15) enddate parameter to report_incidents_by_vendor.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T11:00:00.000Z
CVE-2011-5074 
Multiple cross-site request forgery (CSRF) vulnerabilities in Support Incident Tracker (aka SiT!) before 3.65 allow remote attackers to hijack the authentication of administrators for requests that change administrator email, add a new administrator, or insert arbitrary script via (1) user_profile_edit.php or (2) user_add.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T11:00:00.000Z
CVE-2011-5075 
translate.php in Support Incident Tracker (aka SiT!) 3.45 through 3.65 allows remote attackers to obtain sensitive information via a direct request using the save action, which reveals the installation path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T11:00:00.000Z
CVE-2011-5076 
SQL injection vulnerability in model/comment.class.php in HDWiki 5.0, 5.1, and possibly other versions allows remote attackers to execute arbitrary SQL commands via the PATH_INFO to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-08T00:00:00.000Z
CVE-2011-5077 
Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in image directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-08T00:00:00.000Z
CVE-2011-5078 
The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3 and 7.0 before ESD# 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests, aka Bug IDs 678497 and 678499.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-08T21:00:00.000Z
CVE-2011-5079 
Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "return url parameter."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-14T17:00:00.000Z
CVE-2011-5080 
Cross-site scripting (XSS) vulnerability in lib/class.tx_jftcaforms_tceFunc.php in the Additional TCA Forms (jftcaforms) extension before 0.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-14T17:00:00.000Z
CVE-2011-5081 
Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-18T00:00:00.000Z
CVE-2011-5082 
Cross-site scripting (XSS) vulnerability in the s2Member Pro plugin before 111220 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s2member_pro_authnet_checkout[coupon] parameter (aka Coupon Code field).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-19T18:00:00.000Z
CVE-2011-5083 
Unrestricted file upload vulnerability in inc/swf/swfupload.swf in Dotclear 2.3.1 and 2.4.2 allows remote attackers to execute arbitrary code by uploading a file with an executable PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-19T18:00:00.000Z
CVE-2011-5084 
Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-02T18:00:00.000Z
CVE-2011-5085 
Unspecified vulnerability in Movable Type 4.x before 4.36 and 5.x before 5.05 allows remote attackers to read or modify data via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-02T18:00:00.000Z
CVE-2011-5086 
https50.ocx in IP*Works! SSL in the server in Unitronics UniOPC before 2.0.0 does not properly implement an unspecified function, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-18T10:00:00.000Z
CVE-2011-5087 
Unspecified vulnerability in AdAstrA TRACE MODE Data Center allows remote attackers to read arbitrary files via unknown vectors, as demonstrated by the GLEG Agora SCADA+ Exploit Pack for Immunity CANVAS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-18T10:00:00.000Z
CVE-2011-5088 
The GENESIS32 IcoSetServer ActiveX control in ICONICS GENESIS32 9.21 and BizViz 9.21 configures the trusted zone on the basis of user input, which allows remote attackers to execute arbitrary code via a crafted web site, related to a "Workbench32/WebHMI component SetTrustedZone Policy vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-18T17:00:00.000Z