rainbutterfly/cve_corpus huggingface dataset:
CVE-2015-1164 
Open redirect vulnerability in the serve-static plugin before 1.7.2 for Node.js, when mounted at the root, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the PATH_INFO to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T15:00:00.000Z
CVE-2015-1165 
RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T14:00:00.000Z
CVE-2015-1169 
Apereo Central Authentication Service (CAS) Server before 3.5.3 allows remote attackers to conduct LDAP injection attacks via a crafted username, as demonstrated by using a wildcard and a valid password to bypass LDAP authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-10T20:00:00.000Z
CVE-2015-1170 
The NVIDIA Display Driver R304 before 309.08, R340 before 341.44, R343 before 345.20, and R346 before 347.52 does not properly validate local client impersonation levels when performing a "kernel administrator check," which allows local users to gain administrator privileges via unspecified API calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-06T23:00:00.000Z
CVE-2015-1171 
Stack-based buffer overflow in GSM SIM Utility (aka SIM Card Editor) 6.6 allows remote attackers to execute arbitrary code via a long entry in a .sms file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-28T20:57:00.000Z
CVE-2015-1172 
Unrestricted file upload vulnerability in admin/upload-file.php in the Holding Pattern theme (aka holding_pattern) 0.6 and earlier for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-11T19:00:00.000Z
CVE-2015-1173 
Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does not properly restrict access to the (1) Design Mode and (2) Debug Logger mode modules, which allows remote attackers to gain privileges via crafted "received parameters."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-09-16T18:00:00.000Z
CVE-2015-1174 
Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions via a session id.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-02T19:00:00.000Z
CVE-2015-1175 
Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in the blocklayered module in PrestaShop 1.6.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the layered_price_slider parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T16:00:00.000Z
CVE-2015-1176 
Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in osTicket before 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the status parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2015-1177 
Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2015-1178 
Multiple cross-site scripting (XSS) vulnerabilities in cart.php in X-Cart 5.1.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) product_id or (2) category_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-26T15:00:00.000Z
CVE-2015-1179 
Multiple cross-site scripting (XSS) vulnerabilities in data_point_details.shtm in Mango Automation 2.4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dpid, (2) dpxid, or (3) pid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-26T15:00:00.000Z
CVE-2015-1180 
Cross-site scripting (XSS) vulnerability in the Web Reports in EventSentry 3.1.0 allows remote attackers to inject arbitrary web script or HTML via the pageId parameter to networktile/bullet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2015-1182 
The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL 1.0 through 1.2.12 and 1.3.x through 1.3.9 does not properly initialize a pointer in the asn1_sequence linked list, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ASN.1 sequence in a certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-27T15:00:00.000Z
CVE-2015-1187 
The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-21T16:00:00.000Z
CVE-2015-1188 
The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-05-20T18:00:00.000Z
CVE-2015-1191 
Multiple directory traversal vulnerabilities in pigz 2.3.1 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2015-1192 
Absolute path traversal vulnerability in kgb 1.0b4 allows remote attackers to write to arbitrary files via a full pathname in a crafted archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2015-1193 
Multiple directory traversal vulnerabilities in pax 1:20140703 allow remote attackers to write to arbitrary files via a (1) full pathname or (2) .. (dot dot) in an archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2015-1194 
pax 1:20140703 allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2015-1195 
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2015-1196 
GNU patch 2.7.1 allows remote attackers to write to arbitrary files via a symlink attack in a patch file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T18:00:00.000Z
CVE-2015-1197 
cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-19T00:00:00.000Z
CVE-2015-1198 
Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2015-1199 
Directory traversal vulnerability in ppmd 10.1-5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-28T15:00:00.000Z
CVE-2015-1200 
Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-23T15:00:00.000Z
CVE-2015-1201 
Privoxy before 3.0.22 allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-20T15:00:00.000Z
CVE-2015-1204 
Cross-site scripting (XSS) vulnerability in the Save Filters functionality in the WP Slimstat plugin before 3.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the fs[resource] parameter in the wp-slim-view-2 page to wp-admin/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-21T15:00:00.000Z
CVE-2015-1205 
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-22T22:00:00.000Z
CVE-2015-1206 
Heap-based buffer overflow in Google Chrome before M40 allows remote attackers to cause a denial of service (unpaged memory write and process crash) via a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-06T15:00:00.000Z
CVE-2015-1207 
Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service (memory corruption and crash) via a crafted .m4a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-06-06T18:00:00.000Z
CVE-2015-1208 
Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-01-09T16:00:00.000Z
CVE-2015-1209 
Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a shadow-root anchor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T11:00:00.000Z
CVE-2015-1210 
The V8ThrowException::createDOMException function in bindings/core/v8/V8ThrowException.cpp in the V8 bindings in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, does not properly consider frame access restrictions during the throwing of an exception, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T11:00:00.000Z
CVE-2015-1211 
The OriginCanAccessServiceWorkers function in content/browser/service_worker/service_worker_dispatcher_host.cc in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android does not properly restrict the URI scheme during a ServiceWorker registration, which allows remote attackers to gain privileges via a filesystem: URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T11:00:00.000Z
CVE-2015-1212 
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-02-06T11:00:00.000Z
CVE-2015-1213 
The SkBitmap::ReadRawPixels function in core/SkBitmap.cpp in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1214 
Integer overflow in the SkAutoSTArray implementation in include/core/SkTemplates.h in the filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a reset action with a large count value, leading to an out-of-bounds write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1215 
The filters implementation in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an out-of-bounds write operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1216 
Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1217 
The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1218 
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1219 
Integer overflow in the SkMallocPixelRef::NewAllocate function in core/SkMallocPixelRef.cpp in Skia, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted allocation of a large amount of memory during WebGL rendering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1220 
Use-after-free vulnerability in the GIFImageReader::parseData function in platform/image-decoders/gif/GIFImageReader.cpp in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted frame size in a GIF image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1221 
Use-after-free vulnerability in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging incorrect ordering of operations in the Web SQL Database thread relative to Blink's main thread, related to the shutdown function in web/WebKit.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1222 
Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in content/browser/service_worker/service_worker_script_cache_map.cc in Google Chrome before 41.0.2272.76 allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a ServiceWorkerContextWrapper::DeleteAndStartOver call, related to the NotifyStartedCaching and NotifyFinishedCaching functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1223 
Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change events, as demonstrated by events for invalid input or input to read-only fields, related to the initializeTypeInParsing and updateType functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1224 
The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1225 
PDFium, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1226 
The DebuggerFunction::InitAgentHost function in browser/extensions/api/debugger/debugger_api.cc in Google Chrome before 41.0.2272.76 does not properly restrict what URLs are available as debugger targets, which allows remote attackers to bypass intended access restrictions via a crafted extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1227 
The DragImage::create function in platform/DragImage.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not initialize memory for image drawing, which allows remote attackers to have an unspecified impact by triggering a failed image decoding, as demonstrated by an image for which the default orientation cannot be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1228 
The RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not force a relayout operation and consequently does not initialize memory for a data structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted Cascading Style Sheets (CSS) token sequence.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1229 
net/http/proxy_client_socket.cc in Google Chrome before 41.0.2272.76 does not properly handle a 407 (aka Proxy Authentication Required) HTTP status code accompanied by a Set-Cookie header, which allows remote proxy servers to conduct cookie-injection attacks via a crafted response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1230 
The getHiddenProperty function in bindings/core/v8/V8EventListenerList.h in Blink, as used in Google Chrome before 41.0.2272.76, has a name conflict with the AudioContext class, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via JavaScript code that adds an AudioContext event listener and triggers "type confusion."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1231 
Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1232 
Array index error in the MidiManagerUsb::DispatchSendMidiData function in media/midi/midi_manager_usb.cc in Google Chrome before 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation, a different vulnerability than CVE-2015-1212.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-09T00:00:00.000Z
CVE-2015-1233 
Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T21:00:00.000Z
CVE-2015-1234 
Race condition in gpu/command_buffer/service/gles2_cmd_decoder.cc in Google Chrome before 41.0.2272.118 allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact by manipulating OpenGL ES commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-01T21:00:00.000Z
CVE-2015-1235 
The ContainerNode::parserRemoveChild function in core/dom/ContainerNode.cpp in the HTML parser in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy via a crafted HTML document with an IFRAME element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1236 
The MediaElementAudioSourceNode::process function in modules/webaudio/MediaElementAudioSourceNode.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 42.0.2311.90, allows remote attackers to bypass the Same Origin Policy and obtain sensitive audio sample values via a crafted web site containing a media element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1237 
Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in content/renderer/render_frame_impl.cc in Google Chrome before 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z
CVE-2015-1238 
Skia, as used in Google Chrome before 42.0.2311.90, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-04-19T10:00:00.000Z