rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-3164 
Unspecified vulnerability in HP-UX Containers (formerly HP-UX Secure Resource Partitions (SRP)) A.03.00, A.03.00.002, and A.03.01, when running with patch PHKL_42310, allows local users to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-04T21:00:00.000Z
CVE-2011-3165 
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1208.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-02T17:00:00.000Z
CVE-2011-3166 
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1209.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-02T17:00:00.000Z
CVE-2011-3167 
Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1210.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-02T17:00:00.000Z
CVE-2011-3168 
Unspecified vulnerability in the POP and IMAP service implementations in HP TCP/IP Services 5.6 and 5.7 for OpenVMS allows remote attackers to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-07T20:00:00.000Z
CVE-2011-3169 
Unspecified vulnerability in the SMTP service implementation in HP TCP/IP Services 5.6 and 5.7 for OpenVMS allows remote attackers to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-07T20:00:00.000Z
CVE-2011-3170 
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-19T17:00:00.000Z
CVE-2011-3171 
Directory traversal vulnerability in pure-FTPd 1.0.22 and possibly other versions, when running on SUSE Linux Enterprise Server and possibly other operating systems, when the Netware OES remote server feature is enabled, allows local users to overwrite arbitrary files via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-04T21:00:00.000Z
CVE-2011-3172 unix2_chkpwd do not check for a valid account
A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12.
Problem types: cwe_id: CWE-304
description: CWE-304
Affected products: vendor: SUSE
product: SUSE Linux Enterprise
Credits: lang: en
value: Michael Calmer of SUSE
Published: 2018-06-08T13:00:00.000Z
CVE-2011-3173 
Stack-based buffer overflow in the GetDriverSettings function in nipplib.dll in the iPrint client in Novell Open Enterprise Server 2 (aka OES2) SP3 allows remote attackers to execute arbitrary code via a long (1) hostname or (2) port field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T02:00:00.000Z
CVE-2011-3174 
Buffer overflow in the DoFindReplace function in the ISGrid.Grid2.1 ActiveX control in InstallShield/ISGrid2.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary code via a long bstrReplaceText parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T22:00:00.000Z
CVE-2011-3175 
Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-09T20:00:00.000Z
CVE-2011-3176 
Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-09T20:00:00.000Z
CVE-2011-3177 
The YaST2 network created files with world readable permissions which could have allowed local users to read sensitive material out of network configuration files, like passwords for wireless networks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-08T18:00:00.000Z
CVE-2011-3178 openbuildservice webui code injection
In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode.
Problem types: description: shell code injection
cwe_id: CWE-78
description: CWE-78
Affected products: vendor: opensuse
product: openbuildservice
Published: 2018-03-20T18:00:00.000Z
CVE-2011-3179 
The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T11:00:00.000Z
CVE-2011-3180 
kiwi before 4.98.08, as used in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1, allows attackers to execute arbitrary commands via shell metacharacters in the path of an overlay file, related to chown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-16T18:00:00.000Z
CVE-2011-3181 
Multiple cross-site scripting (XSS) vulnerabilities in the Tracking feature in phpMyAdmin 3.3.x before 3.3.10.4 and 3.4.x before 3.4.4 allow remote attackers to inject arbitrary web script or HTML via a (1) table name, (2) column name, or (3) index name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T17:00:00.000Z
CVE-2011-3182 
PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library functions, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger a buffer overflow by leveraging the ability to provide an arbitrary value for a function argument, related to (1) ext/curl/interface.c, (2) ext/date/lib/parse_date.c, (3) ext/date/lib/parse_iso_intervals.c, (4) ext/date/lib/parse_tz.c, (5) ext/date/lib/timelib.c, (6) ext/pdo_odbc/pdo_odbc.c, (7) ext/reflection/php_reflection.c, (8) ext/soap/php_sdl.c, (9) ext/xmlrpc/libxmlrpc/base64.c, (10) TSRM/tsrm_win32.c, and (11) the strtotime function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-25T14:00:00.000Z
CVE-2011-3183 
A Cross-Site Scripting (XSS) vulnerability exists in the rcID parameter in Concrete CMS 5.4.1.1 and earlier.
Problem types: description: XSS
Affected products: vendor: Concrete CMS
product: Concrete CMS
Published: 2020-01-14T20:08:24.000Z
CVE-2011-3184 
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T17:00:00.000Z
CVE-2011-3185 
gtkutils.c in Pidgin before 2.10.0 on Windows allows user-assisted remote attackers to execute arbitrary programs via a file: URL in a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T17:00:00.000Z
CVE-2011-3186 
CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T18:00:00.000Z
CVE-2011-3187 
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T18:00:00.000Z
CVE-2011-3188 
The (1) IPv4 and (2) IPv6 implementations in the Linux kernel before 3.1 use a modified MD4 algorithm to generate sequence numbers and Fragment Identification values, which makes it easier for remote attackers to cause a denial of service (disrupted networking) or hijack network sessions by predicting these values and sending crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-3189 
The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instead of the hashed string, which might allow remote attackers to bypass authentication via an arbitrary password, a different vulnerability than CVE-2011-2483.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-25T14:00:00.000Z
CVE-2011-3190 
Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-31T23:00:00.000Z
CVE-2011-3191 
Integer signedness error in the CIFSFindNext function in fs/cifs/cifssmb.c in the Linux kernel before 3.1 allows remote CIFS servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a large length value in a response to a read request for a directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-3192 
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T15:00:00.000Z
CVE-2011-3193 
Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-16T00:00:00.000Z
CVE-2011-3194 
Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-16T00:00:00.000Z
CVE-2011-3195 
shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-3196 
The setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-3197 
SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php.  NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-5272 has been assigned for the vps_note parameter to dtcadmin/logPushlet.php vector.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-3198 
Domain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-3199 
Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or unspecified vectors to the (2) DNS and (3) MX form, as demonstrated by the "Domain root TXT record:" field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-20T19:00:00.000Z
CVE-2011-3200 
Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T16:00:00.000Z
CVE-2011-3201 
GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-08T21:00:00.000Z
CVE-2011-3202 
A Cross-Site Scripting (XSS) vulnerability exists in the g parameter to index.php in Jcow CMS 4.2 and earlier.
Problem types: description: XSS
Affected products: vendor: Jcow
product: Jcow CMS
Published: 2020-01-14T20:03:39.000Z
CVE-2011-3203 
A Code Execution vulnerability exists the attachment parameter to index.php in Jcow CMS 4.x to 4.2 and 5.2 to 5.2.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: Jcow
product: Jcow CMS
Published: 2020-01-14T19:57:40.000Z
CVE-2011-3204 
hammerhead.cc in Hammerhead 2.1.4 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/hammer.log (aka the HH_LOG file) or (2) the REPORT_LOG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T16:00:00.000Z
CVE-2011-3205 
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response.  NOTE: This issue exists because of a CVE-2005-0094 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T15:00:00.000Z
CVE-2011-3206 
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T00:00:00.000Z
CVE-2011-3207 
crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-22T10:00:00.000Z
CVE-2011-3208 
Stack-based buffer overflow in the split_wildmats function in nntpd.c in nntpd in Cyrus IMAP Server before 2.3.17 and 2.4.x before 2.4.11 allows remote attackers to execute arbitrary code via a crafted NNTP command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-14T17:00:00.000Z
CVE-2011-3209 
The div_long_long_rem implementation in include/asm-x86/div64.h in the Linux kernel before 2.6.26 on the x86 platform allows local users to cause a denial of service (Divide Error Fault and panic) via a clock_gettime system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2011-3210 
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-22T10:00:00.000Z
CVE-2011-3211 
The server in Bcfg2 1.1.2 and earlier, and 1.2 prerelease, allows remote attackers to execute arbitrary commands via shell metacharacters in data received from a client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-15T20:00:00.000Z
CVE-2011-3212 
CoreStorage in Apple Mac OS X 10.7 before 10.7.2 does not ensure that all disk data is encrypted during the enabling of FileVault, which makes it easier for physically proximate attackers to obtain sensitive information by reading directly from the disk device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3213 
The File Systems component in Apple Mac OS X before 10.7.2 does not properly track the specific X.509 certificate that a user manually accepted for an initial https WebDAV connection, which allows man-in-the-middle attackers to hijack WebDAV communication by presenting an arbitrary certificate for a subsequent connection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3214 
IOGraphics in Apple Mac OS X through 10.6.8 does not properly handle a locked-screen state in display sleep mode for an Apple Cinema Display, which allows physically proximate attackers to bypass the password requirement via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3215 
The kernel in Apple Mac OS X before 10.7.2 does not properly prevent FireWire DMA in the absence of a login, which allows physically proximate attackers to bypass intended access restrictions and discover a password by making a DMA request in the (1) loginwindow, (2) boot, or (3) shutdown state.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3216 
The kernel in Apple Mac OS X before 10.7.2 does not properly implement the sticky bit for directories, which might allow local users to bypass intended permissions and delete files via an unlink system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3217 
MediaKit in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted disk image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3218 
The "Save for Web" selection in QuickTime Player in Apple Mac OS X through 10.6.8 exports HTML documents that contain an http link to a script file, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by spoofing the http server during local viewing of an exported document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3219 
Buffer overflow in CoreMedia, as used in Apple iTunes before 10.5, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-12T18:00:00.000Z
CVE-2011-3220 
QuickTime in Apple Mac OS X before 10.7.2 does not properly process URL data handlers in movie files, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3221 
QuickTime in Apple Mac OS X before 10.7.2 does not properly handle the atom hierarchy in movie files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3222 
Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FlashPix file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3223 
Buffer overflow in QuickTime in Apple Mac OS X before 10.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FLIC movie file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3224 
The User Documentation component in Apple Mac OS X through 10.6.8 uses http sessions for updates to App Store help information, which allows man-in-the-middle attackers to execute arbitrary code by spoofing the http server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3225 
The SMB File Server component in Apple Mac OS X 10.7 before 10.7.2 does not prevent all guest users from accessing the share point record of a guest-restricted folder, which allows remote attackers to bypass intended browsing restrictions by leveraging access to the nobody account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3226 
Open Directory in Apple Mac OS X 10.7 before 10.7.2, when an LDAPv3 server is used with RFC 2307 or custom mappings, allows remote attackers to bypass the password requirement by leveraging lack of an AuthenticationAuthority attribute for a user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3227 
libsecurity in Apple Mac OS X before 10.7.2 does not properly handle errors during processing of a nonstandard extension in a Certificate Revocation list (CRL), which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) a crafted (1) web site or (2) e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z