rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-1352 
The PowerVR SGX driver in Android before 2.3.6 allows attackers to gain root privileges via an application that triggers kernel memory corruption using crafted user data to the pvrsrvkm device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-05T15:00:00.000Z
CVE-2011-1353 
Unspecified vulnerability in Adobe Reader 10.x before 10.1.1 on Windows allows local users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-15T10:00:00.000Z
CVE-2011-1355 
Open redirect vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the logoutExitPage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-19T20:00:00.000Z
CVE-2011-1356 
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.19 allows local users to obtain sensitive stack-trace information via a crafted Administration Console request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-19T20:00:00.000Z
CVE-2011-1357 
Cross-site scripting (XSS) vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 before 6.3.0.5, 7.0 before 7.0.0.5, and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-11T22:00:00.000Z
CVE-2011-1359 
Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T15:00:00.000Z
CVE-2011-1360 
Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier, as used in WebSphere Application Server and other products, allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1) manual/ibm/ and (2) htdocs/*/manual/ibm/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-28T01:00:00.000Z
CVE-2011-1362 
Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1308.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-15T02:00:00.000Z
CVE-2011-1364 
Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary Python code via the code parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-30T19:00:00.000Z
CVE-2011-1366 
Unspecified vulnerability in the Import feature in IBM Rational AppScan Enterprise and AppScan Reporting Console 5.2 through 7.9.x and 8.x before 8.0.1.1 allows remote attackers to execute arbitrary commands on an agent server via a crafted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-30T10:00:00.000Z
CVE-2011-1367 
Unspecified vulnerability in the File Load feature in IBM Rational AppScan Standard and Express 7.8.x, 7.9.x, and 8.0.x before 8.0.0.3 allows remote attackers to execute arbitrary commands via a crafted .scan file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-30T10:00:00.000Z
CVE-2011-1368 
The JavaServer Faces (JSF) application functionality in IBM WebSphere Application Server 8.x before 8.0.0.1 does not properly handle requests, which allows remote attackers to read unspecified files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-29T10:00:00.000Z
CVE-2011-1370 
The default configuration of the Sametime configuration servlet (SCS) in the server in IBM Lotus Sametime 7.0 through 8.5.2 does not enable an authentication requirement, which allows remote attackers to read the configuration settings by examining a response message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-29T10:00:00.000Z
CVE-2011-1371 
Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document, a different vulnerability than CVE-2011-4171.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-28T01:00:00.000Z
CVE-2011-1372 
The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-28T11:00:00.000Z
CVE-2011-1373 
Unspecified vulnerability in IBM DB2 9.7 before FP5 on UNIX, when the Self Tuning Memory Manager (STMM) feature and the AUTOMATIC DATABASE_MEMORY setting are configured, allows local users to cause a denial of service (daemon crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T23:00:00.000Z
CVE-2011-1374 
Buffer overflow in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted REGION record in a PICT file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-09T19:00:00.000Z
CVE-2011-1375 
IBM AIX 6.1 and 7.1 does not restrict the wpar_limits_config and wpar_limits_modify system calls, which allows local users to cause a denial of service (system crash) via a crafted call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-11T21:00:00.000Z
CVE-2011-1376 
iscdeploy in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43, 7.0 before 7.0.0.21, and 8.0 before 8.0.0.2 on the IBM i platform sets weak permissions under systemapps/isclite.ear/ and bin/client_ffdc/, which allows local users to read or modify files via standard filesystem operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T11:00:00.000Z
CVE-2011-1377 
The Web Services Security component in the Web Services Feature Pack before 6.1.0.41 for IBM WebSphere Application Server (WAS) 6.1 does not properly handle the enabling of WS-Security for a JAX-WS application, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-15T02:00:00.000Z
CVE-2011-1378 
IBM WebSphere MQ 6.0 on OpenVMS, when the default rights of the MQM group are established, does not properly verify User Authorization File (UAF) data, which allows local users to kill listener processes and the command server via a control command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-26T02:00:00.000Z
CVE-2011-1381 
Unspecified vulnerability in IBM OpenPages GRC Platform 6.1.0.1 before IF4 allows remote attackers to bypass intended access restrictions via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-27T23:00:00.000Z
CVE-2011-1384 
The (1) bin/invscoutClient_VPD_Survey and (2) sbin/invscout_lsvpd programs in invscout.rte before 2.2.0.19 on IBM AIX 7.1, 6.1, 5.3, and earlier allow local users to delete arbitrary files, or trigger inventory scout operations on arbitrary files, via a symlink attack on an unspecified file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-04T02:00:00.000Z
CVE-2011-1385 
IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.1.x and 2.2.x, allows remote attackers to cause a denial of service (system crash) via an ICMP Echo Reply packet that contains 1 in the Identifier field, a different vulnerability than CVE-2012-0194.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-02T22:00:00.000Z
CVE-2011-1386 
IBM Tivoli Federated Identity Manager (TFIM) and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.1.1, 6.2.0, and 6.2.1 do not properly handle signature validations based on SAML 1.0, 1.1, and 2.0, which allows remote attackers to bypass intended authentication or authorization requirements via a non-conforming SAML signature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-04T02:00:00.000Z
CVE-2011-1388 
The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the TestCompatibilityRecordMode method, which allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-23T22:00:00.000Z
CVE-2011-1389 
Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0, Rational License Server 7.x, and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files.  NOTE: this might overlap CVE-2011-4135.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T19:00:00.000Z
CVE-2011-1390 
SQL injection vulnerability in the Maintenance tool in IBM Rational ClearQuest 7.1.1.x before 7.1.1.9, 7.1.2.x before 7.1.2.6, and 8.x before 8.0.0.2 allows remote attackers to execute arbitrary SQL commands by leveraging an error in the user-database upgrade feature.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-14T22:00:00.000Z
CVE-2011-1391 
The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the InsertMarker method, which allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-23T22:00:00.000Z
CVE-2011-1392 
The Blueberry FlashBack ActiveX control in BB FlashBack Recorder.dll in Blueberry BB FlashBack, as used in IBM Rational Rhapsody before 7.6.1 and other products, does not properly implement the (1) Start, (2) PauseAndSave, (3) InsertMarker, and (4) InsertSoundToFBRAtMarker methods, which allows remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-23T22:00:00.000Z
CVE-2011-1393 
Unspecified vulnerability in the authentication functionality in the server in IBM Lotus Domino 8.x before 8.5.2 FP4 allows remote attackers to cause a denial of service (daemon crash) via a crafted Notes RPC packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T11:00:00.000Z
CVE-2011-1394 
IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allow remote attackers to cause a denial of service (memory consumption) by establishing many UI sessions within one HTTP session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-1395 
Cross-site scripting (XSS) vulnerability in imicon.jsp in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the controlid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-1396 
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote attackers to inject arbitrary web script or HTML via the reportType parameter to an unspecified component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-1397 
Cross-site request forgery (CSRF) vulnerability in the Labor Reporting page in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to hijack the authentication of arbitrary users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-1398 
The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage return characters), which allows remote attackers to bypass an HTTP response-splitting protection mechanism via a crafted URL, related to improper interaction between the PHP header function and certain browsers, as demonstrated by Internet Explorer and Google Chrome.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-30T22:00:00.000Z
CVE-2011-1400 
The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute arbitrary code via a crafted TeX document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-25T19:00:00.000Z
CVE-2011-1401 
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-11T18:00:00.000Z
CVE-2011-1402 
Mahara before 1.3.6 allows remote authenticated users to bypass intended access restrictions, and suspend a user account, edit a view, visit a view, edit a plan artefact, read a plans block, read a plan artefact, edit a blog, read a blog block, read a blog artefact, or access a block, via a request associated with (1) admin/users/search.json.php, (2) view/newviewtoken.json.php, (3) lib/mahara.php, (4) artefact/plans/tasks.json.php, (5) artefact/plans/viewtasks.json.php, (6) artefact/blog/view/index.json.php, (7) artefact/blog/posts.json.php, or (8) blocktype/myfriends/myfriends.json.php, related to incorrect privilege enforcement, a missing user id check, and incorrect enforcement of the Overriding Start/Stop Dates setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-13T22:00:00.000Z
CVE-2011-1403 
Cross-site request forgery (CSRF) vulnerability in the pieforms implementation in Mahara before 1.3.6 allows remote attackers to hijack the authentication of arbitrary users for requests to any form, related to inappropriate regeneration of session keys.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-13T22:00:00.000Z
CVE-2011-1404 
Mahara before 1.3.6 does not properly restrict the data in responses to AJAX calls, which allows remote authenticated users to obtain sensitive information via a request associated with (1) blocktype/myfriends/myfriends.json.php, (2) json/usersearch.php, (3) group/membersearchresults.json.php, or (4) json/friendsearch.php, as demonstrated by information about friends and e-mail addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-13T22:00:00.000Z
CVE-2011-1405 
Cross-site scripting (XSS) vulnerability in Mahara before 1.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors associated with HTML e-mail messages, related to artefact/comment/lib.php and interaction/forum/lib.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-13T22:00:00.000Z
CVE-2011-1406 
Mahara before 1.3.6 does not properly handle an https URL in the wwwroot configuration setting, which makes it easier for user-assisted remote attackers to obtain credentials by sniffing the network at a time when an http URL is used for a login.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-13T22:00:00.000Z
CVE-2011-1407 
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-16T18:00:00.000Z
CVE-2011-1408 
ikiwiki before 3.20110608 allows remote attackers to hijack root's tty and run symlink attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-29T19:51:39.000Z
CVE-2011-1409 
Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-24T20:00:00.000Z
CVE-2011-1411 
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-02T23:00:00.000Z
CVE-2011-1412 
sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-04T01:00:00.000Z
CVE-2011-1413 
Google Chrome before 10.0.648.127 on Linux does not properly mitigate an unspecified flaw in an X server, which allows remote attackers to cause a denial of service (application crash) via vectors involving long messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-11T01:00:00.000Z
CVE-2011-1414 
Cross-site scripting (XSS) vulnerability in the tibbr web server, as used in TIBCO tibbr 1.0.0 through 1.5.0 and tibbr Service 1.0.0 through 1.5.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-22T17:00:00.000Z
CVE-2011-1416 
The Research In Motion (RIM) BlackBerry Torch 9800 with firmware 6.0.0.246 allows attackers to read the contents of memory locations via unknown vectors, as demonstrated by Vincenzo Iozzo, Willem Pinckaers, and Ralf-Philipp Weinmann during a Pwn2Own competition at CanSecWest 2011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-11T17:00:00.000Z
CVE-2011-1417 
Integer overflow in QuickLook, as used in Apple Mac OS X before 10.6.7 and MobileSafari in Apple iOS before 4.2.7 and 4.3.x before 4.3.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a Microsoft Office document with a crafted size field in the OfficeArtMetafileHeader, related to OfficeArtBlip, as demonstrated on the iPhone by Charlie Miller and Dion Blazakis during a Pwn2Own competition at CanSecWest 2011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-11T17:00:00.000Z
CVE-2011-1418 
The stateless address autoconfiguration (aka SLAAC) functionality in the IPv6 networking implementation in Apple iOS before 4.3 and Apple TV before 4.2 places the MAC address into the IPv6 address, which makes it easier for remote IPv6 servers to track users by logging source IPv6 addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-11T22:00:00.000Z
CVE-2011-1419 
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-14T19:00:00.000Z
CVE-2011-1420 
EMC Data Protection Advisor Collector 5.7 and 5.7.1 on Solaris SPARC platforms uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-28T16:00:00.000Z
CVE-2011-1421 
EMC NetWorker 7.5.x before 7.5.4.3 and 7.6.x before 7.6.1.5, when the client push feature is enabled, uses weak permissions for an unspecified file, which allows local users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-22T10:00:00.000Z
CVE-2011-1422 
Cross-site scripting (XSS) vulnerability in an unspecified Shockwave Flash file in EMC RSA Adaptive Authentication On-Premise (AAOP) 2.x, 5.7.x, and 6.x allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-22T10:00:00.000Z
CVE-2011-1423 
Cross-site scripting (XSS) vulnerability in RSA Data Loss Prevention (DLP) Enterprise Manager 8.x before 8.5 SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-05T01:00:00.000Z
CVE-2011-1424 
The default configuration of ExShortcut\Web.config in EMC SourceOne Email Management before 6.6 SP1, when the Mobile Services component is used, does not properly set the localOnly attribute of the trace element, which allows remote authenticated users to obtain sensitive information via ASP.NET Application Tracing.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-24T23:00:00.000Z
CVE-2011-1425 
xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-03T01:00:00.000Z