rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-3694 
Cross-site request forgery (CSRF) vulnerability in the Horde Application Framework before 3.3.9 allows remote attackers to hijack the authentication of unspecified victims for requests to a preference form.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-09T20:00:00.000Z
CVE-2010-3695 
Cross-site scripting (XSS) vulnerability in fetchmailprefs.php in Horde IMP before 4.3.8, and Horde Groupware Webmail Edition before 1.2.7, allows remote attackers to inject arbitrary web script or HTML via the fm_id parameter in a fetchmail_prefs_save action, related to the Fetchmail configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-31T22:00:00.000Z
CVE-2010-3696 
The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-07T20:21:00.000Z
CVE-2010-3697 
The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10, in certain circumstances involving long-term database outages, does not properly handle long queue times for requests, which allows remote attackers to cause a denial of service (daemon crash) by sending many requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-07T20:21:00.000Z
CVE-2010-3698 
The KVM implementation in the Linux kernel before 2.6.36 does not properly reload the FS and GS segment registers, which allows host OS users to cause a denial of service (host OS crash) via a KVM_RUN ioctl call in conjunction with a modified Local Descriptor Table (LDT).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-26T18:23:00.000Z
CVE-2010-3699 
The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly, related to (1) netback, (2) blkback, or (3) blktap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-08T19:00:00.000Z
CVE-2010-3700 
VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-29T18:00:00.000Z
CVE-2010-3701 
lib/MessageStoreImpl.cpp in Red Hat Enterprise MRG before 1.2.2 allows remote authenticated users to cause a denial of service (stack memory exhaustion and broker crash) via a large persistent message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-12T20:00:00.000Z
CVE-2010-3702 
The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T17:00:00.000Z
CVE-2010-3703 
The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other products, allows context-dependent attackers to cause a denial of service (crash) via a PDF file that triggers an uninitialized pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T17:00:00.000Z
CVE-2010-3704 
The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T17:00:00.000Z
CVE-2010-3705 
The sctp_auth_asoc_get_hmac function in net/sctp/auth.c in the Linux kernel before 2.6.36 does not properly validate the hmac_ids array of an SCTP peer, which allows remote attackers to cause a denial of service (memory corruption and panic) via a crafted value in the last element of this array.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-26T19:00:00.000Z
CVE-2010-3706 
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-06T16:00:00.000Z
CVE-2010-3707 
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-06T16:00:00.000Z
CVE-2010-3708 
The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-30T20:00:00.000Z
CVE-2010-3709 
The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-08T23:00:00.000Z
CVE-2010-3710 
Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3, when FILTER_VALIDATE_EMAIL mode is used, allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-25T19:00:00.000Z
CVE-2010-3711 
libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-27T22:00:00.000Z
CVE-2010-3712 
Cross-site scripting (XSS) vulnerability in Joomla! 1.5.x before 1.5.21 and 1.6.x before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving "multiple encoded entities," as demonstrated by the query string to index.php in the com_weblinks or com_content component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-27T22:00:00.000Z
CVE-2010-3713 
rss.php in UseBB before 1.0.11 does not properly handle forum configurations in which a user has the view permission but not the read permission, which allows remote attackers to bypass intended access restrictions by reading a forum feed in combination with a topic feed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-27T22:00:00.000Z
CVE-2010-3714 
The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-25T19:00:00.000Z
CVE-2010-3715 
Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function, and allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (2) the backend.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-25T19:00:00.000Z
CVE-2010-3716 
The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-25T19:00:00.000Z
CVE-2010-3717 
The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTER_VALIDATE_EMAIL operations in PHP, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string, a related issue to CVE-2010-3710.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-25T19:00:00.000Z
CVE-2010-3718 
Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-10T17:00:00.000Z
CVE-2010-3719 
Eval injection vulnerability in IMAdminSchedTask.asp in the administrative interface for Symantec IM Manager 8.4.16 and earlier allows remote attackers to execute arbitrary code via unspecified parameters to the ScheduleTask method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2010-3729 
The SPDY protocol implementation in Google Chrome before 6.0.472.62 does not properly manage buffers, which might allow remote attackers to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3730 
Google Chrome before 6.0.472.62 does not properly use information about the origin of a document to manage properties, which allows remote attackers to have an unspecified impact via a crafted web site, related to a "property pollution" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3731 
Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long username string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3732 
The DRDA Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (database server ABEND) by using the client CLI on Linux, UNIX, or Windows for executing a prepared statement with a large number of parameter markers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3733 
The Engine Utilities component in IBM DB2 UDB 9.5 before FP6a uses world-writable permissions for the sqllib/cfg/db2sprf file, which might allow local users to gain privileges by modifying this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3734 
The Install component in IBM DB2 UDB 9.5 before FP6a on Linux, UNIX, and Windows enforces an unintended limit on password length, which makes it easier for attackers to obtain access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3735 
The "Query Compiler, Rewrite, Optimizer" component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (CPU consumption) via a crafted query involving certain UNION ALL views, leading to an indefinitely large amount of compilation time.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3736 
Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a, when the connection concentrator is enabled, allows remote authenticated users to cause a denial of service (heap memory consumption) by using a different code page than the database server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3737 
Memory leak in the Relational Data Services component in IBM DB2 UDB 9.5 before FP6a allows remote authenticated users to cause a denial of service (heap memory consumption) by executing a (1) user-defined function (UDF) or (2) stored procedure while using a different code page than the database server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3738 
The Security component in IBM DB2 UDB 9.5 before FP6a logs AUDIT events by using a USERID and an AUTHID value corresponding to the instance owner, instead of a USERID and an AUTHID value corresponding to the logged-in user account, which makes it easier for remote authenticated users to execute Audit administration commands without discovery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3739 
The audit facility in the Security component in IBM DB2 UDB 9.5 before FP6a uses instance-level audit settings to capture connection (aka CONNECT and AUTHENTICATION) events in certain circumstances in which database-level audit settings were intended, which might make it easier for remote attackers to connect without discovery.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3740 
The Net Search Extender (NSE) implementation in the Text Search component in IBM DB2 UDB 9.5 before FP6a does not properly handle an alphanumeric Fuzzy search, which allows remote authenticated users to cause a denial of service (memory consumption and system hang) via the db2ext.textSearch function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3741 
The offline backup mechanism in Research In Motion (RIM) BlackBerry Desktop Software uses single-iteration PBKDF2, which makes it easier for local users to decrypt a .ipd file via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3742 
Multiple PHP remote file inclusion vulnerabilities in themes/default/index.php in Free Simple CMS 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) meta or (2) phpincdir parameter, a different issue than CVE-2010-3307.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T17:00:00.000Z
CVE-2010-3743 
Directory traversal vulnerability in Visual Synapse HTTP Server 1.0 RC1 through RC3, and 0.60 and earlier, allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-08T20:00:00.000Z
CVE-2010-3747 
An ActiveX control in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly initialize an unspecified object component during parsing of a CDDA URI, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and application crash) via a long URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-18T22:00:00.000Z
CVE-2010-3748 
Stack-based buffer overflow in the RichFX component in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 allows remote attackers to have an unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-18T22:00:00.000Z
CVE-2010-3749 
The browser-plugin implementation in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1 allows remote attackers to arguments to the RecordClip method, which allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via a " (double quote) in an argument to the RecordClip method, aka "parameter injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-18T22:00:00.000Z
CVE-2010-3750 
rjrmrpln.dll in RealNetworks RealPlayer 11.0 through 11.1, RealPlayer SP 1.0 through 1.1.4, and RealPlayer Enterprise 2.1.2 does not properly validate file contents that are used during interaction with a heap buffer, which allows remote attackers to execute arbitrary code via crafted Name Value Property (NVP) elements in logical streams in a media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-18T22:00:00.000Z
CVE-2010-3751 
Multiple heap-based buffer overflows in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 allow remote attackers to execute arbitrary code via a long .smil argument to the (1) tfile, (2) pnmm, or (3) cdda protocol handler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-18T22:00:00.000Z
CVE-2010-3752 
programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in (1) cisco_dns_info or (2) cisco_domain_info data in a packet, a different vulnerability than CVE-2010-3302.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3753 
programs/pluto/xauth.c in the client in Openswan 2.6.26 through 2.6.28 allows remote authenticated gateways to execute arbitrary commands via shell metacharacters in the cisco_banner (aka server_banner) field, a different vulnerability than CVE-2010-3308.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3754 
The FXCLI_OraBR_Exec_Command function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 uses values of packet fields to determine the content and length of data copied to memory, which allows remote attackers to execute arbitrary code via a crafted packet.  NOTE: this might overlap CVE-2010-3059.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3755 
The _DAS_ReadBlockReply function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via data in a TCP packet.  NOTE: this might overlap CVE-2010-3060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3756 
The _CalcHashValueWithLength function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 does not properly validate an unspecified length value, which allows remote attackers to cause a denial of service (daemon crash) by sending data over TCP.  NOTE: this might overlap CVE-2010-3060.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3757 
Format string vulnerability in the _Eventlog function in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to execute arbitrary code via format string specifiers located after a | (pipe) character in a string.  NOTE: this might overlap CVE-2010-3059.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3758 
Multiple stack-based buffer overflows in FastBackServer.exe in the Server in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allow remote attackers to execute arbitrary code via vectors involving the (1) AGI_SendToLog (aka _SendToLog) function; the (2) group, (3) workgroup, or (4) domain name field to the USER_S_AddADGroup function; the (5) user_path variable to the FXCLI_checkIndexDBLocation function; or (6) the _AGI_S_ActivateLTScriptReply (aka ActivateLTScriptReply) function. NOTE: this might overlap CVE-2010-3059.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3759 
FastBackMount.exe in the Mount service in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 writes a certain value to a memory location specified by a UDP packet field, which allows remote attackers to execute arbitrary code via multiple requests.  NOTE: this might overlap CVE-2010-3058.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3760 
FastBackMount.exe in the Mount service in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 does not properly handle a certain failure to allocate memory, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash, and recovery failure) by specifying a large size value within TCP packet data.  NOTE: this might overlap CVE-2010-3061.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z
CVE-2010-3761 
Unspecified vulnerability in IBM Tivoli Storage Manager (TSM) FastBack 5.5.0.0 through 5.5.6.0 and 6.1.0.0 through 6.1.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-700.  NOTE: this might overlap CVE-2010-3058 or CVE-2010-3059.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-05T21:00:00.000Z