rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-4354 
TCPIPS_Story.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted positive integer after the opcode, triggering incorrect function-pointer processing that can lead to a buffer overflow.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-19T20:00:00.000Z
CVE-2012-4355 
TCPIPS_Story.dll in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a port-46824 TCP packet with a crafted negative integer after the opcode, triggering incorrect function-pointer processing that can lead to a buffer overflow.  NOTE: some of these details are obtained from third party information.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4354.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-19T20:00:00.000Z
CVE-2012-4356 
Multiple directory traversal vulnerabilities in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 allow remote attackers to read arbitrary files via port-46824 TCP packets specifying a file-open operation with opcode 0x78 and a .. (dot dot) in a pathname, followed by a file-read operation with opcode (1) 0x96, (2) 0x97, or (3) 0x98.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-19T20:00:00.000Z
CVE-2012-4357 
Array index error in Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 might allow remote attackers to execute arbitrary code by referencing, within a port-46824 TCP packet, an invalid file-pointer index that leads to execution of an EnterCriticalSection code block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-19T20:00:00.000Z
CVE-2012-4358 
Sielco Sistemi Winlog Pro SCADA before 2.07.17 and Winlog Lite SCADA before 2.07.17 do not validate the return value of the realloc function, which allows remote attackers to cause a denial of service (invalid 0x00 write operation and daemon crash) or possibly have unspecified other impact via a port-46824 TCP packet with a crafted positive integer after the opcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-19T20:00:00.000Z
CVE-2012-4359 
Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 do not validate the return value of the realloc function, which allows remote attackers to cause a denial of service (invalid 0x00 write operation and daemon crash) or possibly have unspecified other impact via a port-46824 TCP packet with a crafted negative integer after the opcode.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4358.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-19T20:00:00.000Z
CVE-2012-4360 
Cross-site scripting (XSS) vulnerability in the mod_pagespeed module 0.10.19.1 through 0.10.22.4 for the Apache HTTP Server allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-15T10:00:00.000Z
CVE-2012-4361 
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T22:00:00.000Z
CVE-2012-4362 
hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance has a hardcoded password of L0CAlu53R for the global$agent account, which allows remote attackers to obtain access to a management service via a login: request to TCP port 13838.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T22:00:00.000Z
CVE-2012-4363 
Multiple unspecified vulnerabilities in Adobe Reader through 10.1.4 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, related to "sixteen more crashes affecting Windows, OS X, or both systems."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-21T10:00:00.000Z
CVE-2012-4366 
Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by sniffing the beacon frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-20T00:00:00.000Z
CVE-2012-4377 
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-26T20:00:00.000Z
CVE-2012-4378 
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-26T20:00:00.000Z
CVE-2012-4379 
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T21:00:00.000Z
CVE-2012-4380 
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T21:00:00.000Z
CVE-2012-4381 
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.
Problem types: description: Password
Affected products: vendor: n/a
product: MediaWiki
Published: 2020-02-08T17:50:40.000Z
CVE-2012-4382 
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-19T21:00:00.000Z
CVE-2012-4383 
contao prior to 2.11.4 has a sql injection vulnerability
Problem types: description: SQL injection
Affected products: vendor: contao
product: contao
Published: 2020-01-29T14:42:06.000Z
CVE-2012-4384 
letodms has multiple XSS issues: Reflected XSS in Login Page, Stored XSS in Document Owner/User name, Stored XSS in Calendar
Problem types: description: XSS
Affected products: vendor: letodms
product: letodms
Published: 2019-11-13T15:52:28.000Z
CVE-2012-4385 
letodms 3.3.6 has CSRF via change password
Problem types: description: CSRF
Affected products: vendor: letodms
product: letodms
Published: 2019-11-13T16:02:19.000Z
CVE-2012-4386 
The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4387 
Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4388 
The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1398.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-07T22:00:00.000Z
CVE-2012-4389 
Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.7 allows remote attackers to execute arbitrary code by uploading a crafted .htaccess file in an import.zip file and accessing an uploaded PHP file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4390 
(1) apps/calendar/appinfo/remote.php and (2) apps/contacts/appinfo/remote.php in ownCloud before 4.0.7 allows remote authenticated users to enumerate the registered users via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4391 
Cross-site request forgery (CSRF) vulnerability in core/ajax/appconfig.php in ownCloud before 4.0.7 allows remote attackers to hijack the authentication of administrators for requests that edit the app configurations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4392 
index.php in ownCloud 4.0.7 does not properly validate the oc_token cookie, which allows remote attackers to bypass authentication via a crafted oc_token cookie value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4393 
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users for requests that use (1) addBookmark.php, (2) delBookmark.php, or (3) editBookmark.php in bookmarks/ajax/; (4) calendar/delete.php, (5) calendar/edit.php, (6) calendar/new.php, (7) calendar/update.php, (8) event/delete.php, (9) event/edit.php, (10) event/move.php, (11) event/new.php, (12) import/import.php, (13) settings/setfirstday.php, (14) settings/settimeformat.php, (15) share/changepermission.php, (16) share/share.php, (17) or share/unshare.php in calendar/ajax/; (18) external/ajax/setsites.php, (19) files/ajax/delete.php, (20) files/ajax/move.php, (21) files/ajax/newfile.php, (22) files/ajax/newfolder.php, (23) files/ajax/rename.php, (24) files_sharing/ajax/email.php, (25) files_sharing/ajax/setpermissions.php, (26) files_sharing/ajax/share.php, (27) files_sharing/ajax/toggleresharing.php, (28) files_sharing/ajax/togglesharewitheveryone.php, (29) files_sharing/ajax/unshare.php, (30) files_texteditor/ajax/savefile.php, (31) files_versions/ajax/rollbackVersion.php, (32) gallery/ajax/createAlbum.php, (33) gallery/ajax/sharing.php, (34) tasks/ajax/addtask.php, (35) tasks/ajax/addtaskform.php, (36) tasks/ajax/delete.php, or (37) tasks/ajax/edittask.php in apps/; or administrators for requests that use (38) changepassword.php, (39) creategroup.php, (40) createuser.php, (41) disableapp.php, (42) enableapp.php, (43) lostpassword.php, (44) removegroup.php, (45) removeuser.php, (46) setlanguage.php, (47) setloglevel.php, (48) setquota.php, or (49) togglegroups.php in settings/ajax/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4394 
Cross-site scripting (XSS) vulnerability in apps/files/js/filelist.js in ownCloud before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4395 
Cross-site scripting (XSS) vulnerability in index.php in ownCloud before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via the redirect_url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4396 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) file names to apps/user_ldap/settings.php; (2) url or (3) title parameter to apps/bookmarks/ajax/editBookmark.php; (4) tag or (5) page parameter to apps/bookmarks/ajax/updateList.php; (6) identity to apps/user_openid/settings.php; (7) stack name in apps/gallery/lib/tiles.php; (8) root parameter to apps/gallery/templates/index.php; (9) calendar displayname in apps/calendar/templates/part.import.php; (10) calendar uri in apps/calendar/templates/part.choosecalendar.rowfields.php; (11) title, (12) location, or (13) description parameter in apps/calendar/lib/object.php; (14) certain vectors in core/js/multiselect.js; or (15) artist, (16) album, or (17) title comments parameter in apps/media/lib_scanner.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4397 
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) calendar displayname to part.choosecalendar.rowfields.php or (2) part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or (3) unspecified vectors to apps/contacts/lib/vcard.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-4398 
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T02:00:00.000Z
CVE-2012-4399 
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-4400 
repository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T10:00:00.000Z
CVE-2012-4401 
Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T10:00:00.000Z
CVE-2012-4402 
webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote authenticated users to run arbitrary external-service functions via a token intended for only one service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T10:00:00.000Z
CVE-2012-4403 
theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T10:00:00.000Z
CVE-2012-4404 
security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-10T22:00:00.000Z
CVE-2012-4405 
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (icclib), as used in Ghostscript 9.06 and Argyll Color Management System, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted (1) PostScript or (2) PDF file with embedded images, which triggers a heap-based buffer overflow.  NOTE: this issue is also described as an array index error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-18T17:00:00.000Z
CVE-2012-4406 
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4407 
lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T10:00:00.000Z
CVE-2012-4408 
course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T10:00:00.000Z
CVE-2012-4409 
Stack-based buffer overflow in the check_file_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to execute arbitrary code via an encrypted file with a crafted header containing long salt data that is not properly handled during decryption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-4411 
The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qemu monitor.  NOTE: this might be a duplicate of CVE-2007-0998.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-4412 
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-09T22:00:00.000Z
CVE-2012-4413 
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-18T17:00:00.000Z
CVE-2012-4414 
Multiple SQL injection vulnerabilities in the replication code in Oracle MySQL possibly before 5.5.29, and MariaDB 5.1.x through 5.1.62, 5.2.x through 5.2.12, 5.3.x through 5.3.7, and 5.5.x through 5.5.25, allow remote authenticated users to execute arbitrary SQL commands via vectors related to the binary log.  NOTE: as of 20130116, Oracle has not commented on claims from a downstream vendor that the fix in MySQL 5.5.29 is incomplete.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-22T23:00:00.000Z
CVE-2012-4415 
Stack-based buffer overflow in the guac_client_plugin_open function in libguac in Guacamole before 0.6.3 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long protocol name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T01:00:00.000Z
CVE-2012-4416 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Hotspot.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-16T21:29:00.000Z
CVE-2012-4417 
GlusterFS 3.3.0, as used in Red Hat Storage server 2.0, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-18T23:00:00.000Z
CVE-2012-4418 
Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-4419 
The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-14T18:00:00.000Z
CVE-2012-4420 
An information disclosure flaw was found in the way the Java Virtual Machine (JVM) implementation of Java SE 7 as provided by OpenJDK 7 incorrectly initialized integer arrays after memory allocation (in certain circumstances they had nonzero elements right after the allocation). A remote attacker could use this flaw to obtain potentially sensitive information.
Problem types: description: Other
Affected products: vendor: java-1.7.0-openjdk
product: java-1.7.0-openjdk
Published: 2019-12-26T20:46:04.000Z
CVE-2012-4421 
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-14T19:00:00.000Z
CVE-2012-4422 
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-14T19:00:00.000Z
CVE-2012-4423 
The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the RPC dispatch table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-19T11:00:00.000Z