rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-3657 
Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when debug mode is used, allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) tabular report, (2) graphical report, or (3) new chart.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-02T19:00:00.000Z
CVE-2011-3658 
The SVG implementation in Mozilla Firefox 8.0, Thunderbird 8.0, and SeaMonkey 2.5 does not properly interact with DOMAttrModified event handlers, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via vectors involving removal of SVG elements.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-21T02:00:00.000Z
CVE-2011-3659 
Use-after-free vulnerability in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 might allow remote attackers to execute arbitrary code via vectors related to incorrect AttributeChildRemoved notifications that affect access to removed nsDOMAttribute child nodes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-01T16:00:00.000Z
CVE-2011-3660 
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors that trigger a compartment mismatch associated with the nsDOMMessageEvent::GetData function, and unknown other vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-21T02:00:00.000Z
CVE-2011-3661 
YARR, as used in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted JavaScript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-21T02:00:00.000Z
CVE-2011-3663 
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to capture keystrokes entered on a web page, even when JavaScript is disabled, by using SVG animation accessKey events within that web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-21T02:00:00.000Z
CVE-2011-3664 
Mozilla Firefox before 9.0, Thunderbird before 9.0, and SeaMonkey before 2.6 on Mac OS X do not properly handle certain DOM frame deletions by plugins, which allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) or possibly have unspecified other impact via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-21T02:00:00.000Z
CVE-2011-3665 
Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an Ogg VIDEO element that is not properly handled after scaling.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-21T02:00:00.000Z
CVE-2011-3666 
Mozilla Firefox before 3.6.25 and Thunderbird before 3.1.17 on Mac OS X do not consider .jar files to be executable files, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted file.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-2372 on Mac OS X.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-21T02:00:00.000Z
CVE-2011-3667 
The User.offer_account_by_email WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when createemailregexp is not empty, does not properly handle user_can_create_account settings, which allows remote attackers to create user accounts by leveraging a token contained in an e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-02T19:00:00.000Z
CVE-2011-3668 
Cross-site request forgery (CSRF) vulnerability in post_bug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that create bug reports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-02T19:00:00.000Z
CVE-2011-3669 
Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-02T19:00:00.000Z
CVE-2011-3670 
Mozilla Firefox before 3.6.26 and 4.x through 6.0, Thunderbird before 3.1.18 and 5.0 through 6.0, and SeaMonkey before 2.4 do not properly enforce the IPv6 literal address syntax, which allows remote attackers to obtain sensitive information by making XMLHttpRequest calls through a proxy and reading the error messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-01T16:00:00.000Z
CVE-2011-3671 
Use-after-free vulnerability in the nsHTMLSelectElement function in nsHTMLSelectElement.cpp in Mozilla Firefox 4.x through 8.0, Thunderbird 5.0 through 8.0, and SeaMonkey before 2.6 allows remote attackers to execute arbitrary code via vectors involving removal of the parent node of an element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-18T19:00:00.000Z
CVE-2011-3684 
Multiple cross-site scripting (XSS) vulnerabilities in Tembria Server Monitor before 6.0.5 Build 2252 allow remote attackers to inject arbitrary web script or HTML via (1) the siteid parameter to logbook.asp, (2) the siteid parameter to monitor-events.asp, (3) the siteid parameter to reports-config-by-device.asp, (4) the siteid parameter to reports-config-by-monitor.asp, (5) the siteid parameter to reports-monitoring-queue.asp, (6) the action parameter to site-list.asp, the (7) siteid or (8) type parameter to event-history.asp, the (9) siteid or (10) type parameter to admin-history.asp, the (11) siteid or (12) id parameter to dashboard-view.asp, the (13) siteid or (14) dn parameter to device-events.asp, the (15) siteid or (16) submit parameter to device-finder.asp, the (17) siteid or (18) dn parameter to device-monitors.asp, the (19) siteid or (20) type parameter to device-views.asp, the (21) siteid or (22) type parameter to monitor-views.asp, the (23) siteid or (24) sel parameter to reports-list.asp, the (25) siteid, (26) action, or (27) sel parameter to monitor-list.asp, or the (28) siteid, (29) action, or (30) sel parameter to device-list.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3685 
Tembria Server Monitor before 6.0.5 Build 2252 uses a substitution cipher to encrypt application credentials, which allows local users to obtain sensitive information by leveraging read access to (1) authentication.dat or (2) XML files in the Exports directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3686 
Multiple cross-site scripting (XSS) vulnerabilities in myAddressBook.asp in Sonexis ConferenceManager 9.2.11.0 and 9.3.14.0 allow remote attackers to inject arbitrary web script or HTML via the (1) fname, (2) lname, (3) email_edit, (4) email, (5) email2, (6) email3, (7) sms, (8) sms_id, or (9) work parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3687 
Multiple cross-site scripting (XSS) vulnerabilities in Sonexis ConferenceManager 9.2.11.0 allow remote attackers to inject arbitrary web script or HTML via (1) the txtConferenceID parameter to HostLogin.asp, (2) the txtConferenceID parameter to ParticipantLogin.asp, (3) the acp parameter to ForgotPIN.asp, or the (4) Description, (5) title, or (6) Heading parameter to Error.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3688 
Multiple SQL injection vulnerabilities in Sonexis ConferenceManager 9.3.14.0 allow remote attackers to execute arbitrary SQL commands via (1) the g parameter to Conference/Audio/AudioResourceContainer.asp or (2) the txtConferenceID parameter to Login/HostLogin.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3689 
Cross-site scripting (XSS) vulnerability in Licenses.html in Wibu-Systems CodeMeter WebAdmin 3.30 and 4.30 allows remote attackers to inject arbitrary web script or HTML via the BoxSerial parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3690 
Untrusted search path vulnerability in PlotSoft PDFill PDF Editor 8.0 allows local users to gain privileges via a Trojan horse mfc70enu.dll or mfc80loc.dll in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3691 
Untrusted search path vulnerability in Foxit Reader before 5.0.2.0718 allows local users to gain privileges via a Trojan horse dwmapi.dll, dwrite.dll, or msdrm.dll in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3692 
NetSaro Enterprise Messenger Server 2.0 stores cleartext console credentials in configuration.xml, which allows local users to obtain sensitive information by reading this file and performing a base64 decoding step.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3693 
NetSaro Enterprise Messenger Server 2.0 allows local users to discover cleartext server credentials by reading the NetSaro.fdb file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3694 
The Server Administration Console in NetSaro Enterprise Messenger Server 2.0 allows remote attackers to read application source code by appending a %00 character to a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-27T19:00:00.000Z
CVE-2011-3695 
111WebCalendar 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by footer.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3696 
60cycleCMS 2.5.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by post.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3697 
Achievo 1.4.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/graph/jpgraph/jpgraph_radar.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3698 
AdaptCMS 2.0.2 Beta allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by inc/poll_vote.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3699 
John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/test-active-record.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3700 
Advanced Electron Forum (AEF) 1.0.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by languages/english/deletetopic_lang.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3701 
AlegroCart 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by common.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3702 
Ananta Gazelle 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/template.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3703 
AneCMS 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/menu/index.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3704 
appRain 0.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by cron.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3705 
Arctic Fox CMS 0.9.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by acp/includes/edit.inc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3706 
ATutor 2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by users/tool_settings.inc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3707 
JanRain PHP OpenID library (aka php-openid) 2.2.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Auth/Yadis/Yadis.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3708 
Automne 4.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/page-redirect-info.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3709 
b2evolution 3.3.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by locales/ru_RU/ru-RU.locale.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3710 
bbPress 1.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by bb-templates/kakumei/view.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3711 
BIGACE 2.7.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/libs/javascript.inc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3712 
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3713 
cFTP r80 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/session_check.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3714 
ClanSphere 2010.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by mods/board/attachment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3715 
ClanTiger 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by widgets/statistics/statistics.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3716 
Claroline 1.9.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by work/connector/linker.cnr.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3717 
ClipBucket 2.0.9 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/signup_captcha/signup_captcha.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3718 
CMS Made Simple (CMSMS) 1.9.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/TinyMCE/TinyMCE.module.php and certain other files.  NOTE: this might overlap CVE-2007-5444.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3719 
CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3720 
conceptcms 5.3.1, 5.3.3, and possibly other versions allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by sys_libs/umlib/um_authserver.inc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3721 
concrete 5.4.0.5, 5.4.1, and 5.4.1.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tools/spellchecker_service.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3722 
Coppermine Photo Gallery (CPG) 1.5.12 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by include/inspekt.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3723 
Crafty Syntax 3.0.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by README_FILES/livehelp.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3724 
CubeCart 4.4.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/shipping/USPS/calc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3725 
DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by header_html.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3726 
DoceboLMS 4.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by views/dummy/show.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3727 
DokuWiki 2009-12-25c allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/tpl/index.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3728 
Dolphin 7.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xmlrpc/BxDolXMLRPCProfileView.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3729 
dotproject 2.1.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by style/dp-grey-theme/footer.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3730 
Drupal 7.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/simpletest/tests/upgrade/drupal-6.upload.database.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z
CVE-2011-3731 
e107 0.7.24 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by e107_plugins/pdf/e107pdf.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-23T23:00:00.000Z