rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4786 
A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4787.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-12T19:00:00.000Z
CVE-2011-4787 
A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and CVE-2011-4786.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-12T19:00:00.000Z
CVE-2011-4788 
Absolute path traversal vulnerability in the web interface on HP StorageWorks P2000 G3 MSA array systems allows remote attackers to read arbitrary files via a pathname in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-13T02:00:00.000Z
CVE-2011-4789 
Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbitrary code via a crafted size value in a packet.  NOTE: it was originally reported that the affected product is HP Diagnostics Server, but HP states that "the vulnerable product is actually HP LoadRunner."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-13T02:00:00.000Z
CVE-2011-4790 
Unspecified vulnerability in HP Network Automation 7.5x, 7.6x, 9.0, and 9.10 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-02T00:00:00.000Z
CVE-2011-4791 
DBServer.exe in HP Data Protector Media Operations 6.11 and earlier allows remote attackers to execute arbitrary code via a crafted request containing a large value in a length field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-03T02:00:00.000Z
CVE-2011-4800 
Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users to read and write arbitrary files, and list and create arbitrary directories, via a "..:/" (dot dot colon forward slash) in the (1) list, (2) put, or (3) get commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4801 
SQL injection vulnerability in akeyActivationLogin.do in Authenex Web Management Control in Authenex Strong Authentication System (ASAS) Server 3.1.0.2 and 3.1.0.3 allows remote attackers to execute arbitrary SQL commands via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4802 
Multiple SQL injection vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) sortfield, (2) sortorder, and (3) sall parameters to user/index.php and (b) user/group/index.php; the id parameter to (4) info.php, (5) perms.php, (6) param_ihm.php, (7) note.php, and (8) fiche.php in user/; and (9) rowid parameter to admin/boxes.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4803 
SQL injection vulnerability in wptouch/ajax.php in the WPTouch plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4804 
Directory traversal vulnerability in the obSuggest (com_obsuggest) component before 1.8 for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4805 
Cross-site scripting (XSS) vulnerability in pubDBLogon.jsp in SAP Crystal Report Server 2008 allows remote attackers to inject arbitrary web script or HTML via the service parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4806 
Multiple cross-site scripting (XSS) vulnerabilities in main.php in phpAlbum 0.4.1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) var1 and (2) keyword parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4807 
Directory traversal vulnerability in main.php in phpAlbum 0.4.1.16 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the var1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4808 
SQL injection vulnerability in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a fnd_home action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4809 
Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) language[], (2) university[], (3) persent[], (4) company_name[], (5) designation[], (6) music[], (7) books[], (8) movies[], (9) games[], (10) syp[], (11) ft[], and (12) fa[] parameters in a save task for a profile to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4810 
Multiple directory traversal vulnerabilities in WHMCompleteSolution (WHMCS) 3.x and 4.x allow remote attackers to read arbitrary files via the templatefile parameter to (1) submitticket.php and (2) downloads.php, and (3) the report parameter to admin/reports.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4811 
SQL injection vulnerability in pokaz_podkat.php in BestShopPro allows remote attackers to execute arbitrary SQL commands via the str parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4812 
Cross-site scripting (XSS) vulnerability in nowosci.php in BestShopPro allows remote attackers to inject arbitrary web script or HTML via the str parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4813 
Directory traversal vulnerability in clientarea.php in WHMCompleteSolution (WHMCS) 3.x.x allows remote attackers to read arbitrary files via an invalid action and a ../ (dot dot slash) in the templatefile parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4814 
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php, (2) admin/boxes.php, (3) comm/clients.php, (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-4815 
Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-4816 
SQL injection vulnerability in the KPI component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-4817 
The About option on the Help menu in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 shows the username, which might allow remote authenticated users to have an unspecified impact via a targeted attack against the corresponding user account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-4818 
Open redirect vulnerability in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the uisessionid parameter to an unspecified component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-4819 
Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to (1) maximo.jsp or (2) the default URI under ui/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-13T01:00:00.000Z
CVE-2011-4820 
IBM Rational Asset Manager 7.5 could allow a remote attacker to bypass security restrictions. An attacker could exploit this vulnerability using the UID parameter to modify another user's preferences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-08-26T20:48:20.000Z
CVE-2011-4821 
Directory traversal vulnerability in the TFTP server in D-Link DIR-601 Wireless N150 Home Router with firmware 1.02NA allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-20T14:00:00.000Z
CVE-2011-4822 
Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment, which is not properly handled in a Confluence page, or (2) the user profile display name, which is not properly handled in a FishEye page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4823 
Multiple SQL injection vulnerabilities in Vik Real Estate (com_vikrealestate) component 1.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) contract parameter in a results action and (2) imm parameter in a show action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4824 
SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4825 
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4826 
SQL injection vulnerability in session.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the user parameter to process.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4827 
Multiple cross-site scripting (XSS) vulnerabilities in AutoSec Tools V-CMS 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) p parameter to redirect.php and (2) box parameter to includes/TrueColorPicker/index.php, which is not properly handled in includes/TrueColorPicker/class.TrueColorPicker.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4828 
Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4829 
SQL injection vulnerability in the com_listing component in Barter Sites component 1.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the category_id parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4830 
Multiple cross-site scripting (XSS) vulnerabilities in the com_listing component in Barter Sites component 1.3 for Joomla! allow remote authenticated users to inject arbitrary web script or HTML via the (1) listing_title, (2) description, (3) homeurl (aka Website Address), (4) paystring (aka Payment types accepted), (5) sell_price, (6) shipping_cost, and (7) quantity parameters to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4831 
Directory traversal vulnerability in webFileBrowser.php in Web File Browser 0.4b14 allows remote authenticated users to read arbitrary files via a ..%2f (encoded dot dot) in the file parameter in a download action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4832 
Directory traversal vulnerability in CaupoShop Pro 2.x, CaupoShop Classic 3.01, and CaupoShop Pro 3.70 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the template parameter in a template action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4833 
Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4834 
The GetInstalledPackages function in the configuration tool in HP Application Lifestyle Management (ALM) 11 on AIX, HP-UX, and Solaris allows local users to gain privileges via (1) a Trojan horse /tmp/tmp.txt FIFO or (2) a symlink attack on /tmp/tmp.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4835 
Directory traversal vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to access arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4836 
Cross-site scripting (XSS) vulnerability in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to inject arbitrary web script or HTML via a request for a crafted URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4837 
Cross-site request forgery (CSRF) vulnerability in /ctrl in the web interface in HomeSeer HS2 2.5.0.20 allows remote attackers to hijack the authentication of admins for requests that execute arbitrary programs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-15T02:00:00.000Z
CVE-2011-4838 
JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-4847 
SQL injection vulnerability in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allows remote attackers to execute arbitrary SQL commands via a certificateslist cookie to notification@/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4848 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes a submitted password within an HTTP response body, which allows remote attackers to obtain sensitive information by sniffing the network, as demonstrated by password handling in certain files under client@1/domain@1/backup/local-repository/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4849 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, as demonstrated by cookies used by help.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4850 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie, as demonstrated by cookies used by help.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4851 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates a password form field without disabling the autocomplete feature, which makes it easier for remote attackers to bypass authentication by leveraging an unattended workstation, as demonstrated by forms in server/google-tools/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4852 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 generates web pages containing external links in response to GET requests with query strings for enterprise/mobile-monitor/ and certain other files, which makes it easier for remote attackers to obtain sensitive information by reading (1) web-server access logs or (2) web-server Referer logs, related to a "cross-domain Referer leakage" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4853 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 includes an RFC 1918 IP address within a web page, which allows remote attackers to obtain potentially sensitive information by reading this page, as demonstrated by smb/user/list-data/items-per-page/ and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4854 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 does not ensure that Content-Type HTTP headers match the corresponding Content-Type data in HTML META elements, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving the get_enabled_product_icon program.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4855 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 omits the Content-Type header's charset parameter for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/customer-service-plan/list/reset-search/true/ and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4856 
The Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 sends incorrect Content-Type headers for certain resources, which might allow remote attackers to have an unspecified impact by leveraging an interpretation conflict involving admin/health/parameters and certain other files.  NOTE: it is possible that only clients, not the Plesk product, could be affected by this issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z
CVE-2011-4857 
Heap-based buffer overflow in the in_mod.dll plugin in Winamp before 5.623 allows remote attackers to execute arbitrary code via crafted song message data in an Impulse Tracker (IT) file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T19:00:00.000Z
CVE-2011-4858 
Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-05T19:00:00.000Z
CVE-2011-4859 
The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771* and 140CPU65* modules, the Premium TSXETY* and TSXP57* modules, the M340 BMXNOE01* and BMXP3420* modules, and the STB DIO STBNIC2212 and STBNIP2* modules, uses hardcoded passwords for the (1) AUTCSE, (2) AUT_CSE, (3) fdrusers, (4) ftpuser, (5) loader, (6) nic2212, (7) nimrohs2212, (8) nip2212, (9) noe77111_v500, (10) ntpupdate, (11) pcfactory, (12) sysdiag, (13) target, (14) test, (15) USER, and (16) webserver accounts, which makes it easier for remote attackers to obtain access via the (a) TELNET, (b) Windriver Debug, or (c) FTP port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-17T11:00:00.000Z
CVE-2011-4860 
The ComputePassword function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device (aka the Quantum 140NOE771* module) generates the password for the fwupgrade account by performing a calculation on the MAC address, which makes it easier for remote attackers to obtain access via a (1) ARP request message or (2) Neighbor Solicitation message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-17T11:00:00.000Z
CVE-2011-4861 
The modbus_125_handler function in the Schneider Electric Quantum Ethernet Module on the NOE 771 device (aka the Quantum 140NOE771* module) allows remote attackers to install arbitrary firmware updates via a MODBUS 125 function code to TCP port 502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-17T11:00:00.000Z