rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4726 
Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/health/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4727 
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted REST URL parameter, as demonstrated by parameters to admin/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4728 
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by login_up.php3 and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4729 
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by login_up.php3 and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4730 
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in admin/reseller/login-info/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4731 
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by admin/home/admin and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4732 
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving account/power-mode-logout and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4733 
The Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/disable-featured-applications-promo and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4734 
Multiple SQL injection vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by file-manager/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4735 
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/user/create and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4736 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in login_up.php3 and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4737 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in client@2/domain@1/odbc/dsn@1/properties/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4738 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by get_password.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4739 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/my-profile and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4740 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 generates web pages containing external links in response to GET requests with query strings for smb/app/search-data/catalogId/marketplace and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4741 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 includes a database connection string within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by client@2/domain@1/hosting/aspdotnet/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4742 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/user/list and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4743 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/user/create and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4744 
The Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/admin-home/featured-applications/ and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4745 
Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/index.php/default and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4746 
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not disable the SSL 2.0 protocol, which makes it easier for remote attackers to conduct spoofing attacks by leveraging protocol weaknesses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4747 
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 does not prevent the use of weak ciphers for SSL sessions, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a crafted CipherSuite list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4748 
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/ajax/core/ajax.inc.js and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4749 
The billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms on certain pages under admin/index.php/default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4750 
Multiple cross-site scripting (XSS) vulnerabilities in SmarterTools SmarterStats 6.2.4100 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Default.aspx and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4751 
SmarterTools SmarterStats 6.2.4100 generates web pages containing external links in response to GET requests with query strings for frmGettingStarted.aspx, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4752 
SmarterTools SmarterStats 6.2.4100 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving frmCustomReport.aspx and certain other files.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4753 
Multiple SQL injection vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by domains/sitebuilder_edit.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4754 
Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by smb/app/available/id/apscatalog/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4755 
Parallels Plesk Small Business Panel 10.2.0 does not properly validate string data that is intended for storage in an XML document, which allows remote attackers to cause a denial of service (parsing error) or possibly have unspecified other impact via a crafted cookie, as demonstrated by cookies to client@1/domain@1/hosting/file-manager/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4756 
Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by domains/sitebuilder_edit.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4757 
Parallels Plesk Small Business Panel 10.2.0 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in smb/auth and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4758 
Parallels Plesk Small Business Panel 10.2.0 receives cleartext password input over HTTP, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by forms in smb/auth and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4759 
Parallels Plesk Small Business Panel 10.2.0 generates web pages containing external links in response to GET requests with query strings for client@1/domain@1/hosting/file-manager/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4760 
Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by smb/email-address/list and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4761 
Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving domains/sitebuilder_edit.php and certain other files.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4762 
Parallels Plesk Small Business Panel 10.2.0 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving smb/app/top-categories-data/ and certain other files.  NOTE: it is possible that only clients, not the SmarterStats product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4763 
Multiple SQL injection vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by Wizard/Edit/Html and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4764 
Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by Wizard/Edit/Modules/Image and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4765 
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by Wizard/Edit/Modules/ImageGallery/MultiImagesUpload and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4766 
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allows remote attackers to obtain ASP source code via a direct request to wysiwyg/fckconfig.js.  NOTE: CVE disputes this issue because ASP is only used in a JavaScript comment
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4767 
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 has web pages containing e-mail addresses that are not intended for correspondence about the local application deployment, which allows remote attackers to obtain potentially sensitive information by reading a page, as demonstrated by js/Wizard/Status.js and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4768 
The Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving Wizard/Edit/Modules/Image and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4769 
The 360 MobileSafe (com.qihoo360.mobilesafe) application 2.x before 2.3.0 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4770 
The QIWI Wallet (ru.mw) application before 1.14.2 for Android does not properly protect data, which allows remote attackers to read or modify financial information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4771 
The Scan to PDF Free (com.scan.to.pdf.trial) application 2.0.4 for Android does not properly protect data, which allows remote attackers to read or modify scanned files and a Google account via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4772 
The 360 KouXin (com.qihoo360.kouxin) application 1.5.3 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4773 
The AnGuanJia (com.anguanjia.safe) application 2.10.343 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and a contact list via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4776 
Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script, as demonstrated by admin/update/settings/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4777 
Cross-site scripting (XSS) vulnerability in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to inject arbitrary web script or HTML via the login parameter to preferences.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4778 
Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 4.2.x before 4.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPL-44614.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-03T11:00:00.000Z
CVE-2011-4780 
Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters, related to the export panels in the (1) server, (2) database, and (3) table sections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-22T20:00:00.000Z
CVE-2011-4782 
Cross-site scripting (XSS) vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-22T20:00:00.000Z
CVE-2011-4783 
The IDAPython plugin before 1.5.2.3 in IDA Pro allows user-assisted remote attackers to execute arbitrary code via a crafted IDB file, related to improper handling of certain swig_runtime_data files in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T11:00:00.000Z
CVE-2011-4784 
The NVIDIA Stereoscopic 3D driver before 7.17.12.7565 does not properly handle commands sent to a named pipe, which allows local users to gain privileges via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T02:00:00.000Z
CVE-2011-4785 
Directory traversal vulnerability in the HP-ChaiSOE/1.0 web server on the HP LaserJet P3015 printer with firmware before 07.080.3, LaserJet 4650 printer with firmware 07.006.0, and LaserJet 2430 printer with firmware 08.113.0_I35128 allows remote attackers to read arbitrary files via unspecified vectors, a different vulnerability than CVE-2008-4419.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-10T11:00:00.000Z