rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4036 
Directory traversal vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier, CitectHistorian 4.30 and earlier, and CitectSCADAReports 4.10 and earlier allows remote attackers to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T11:00:00.000Z
CVE-2011-4037 
Buffer overflow in Sielco Sistemi Winlog PRO before 2.07.09 and Winlog Lite before 2.07.09 allows user-assisted remote attackers to execute arbitrary code via invalid data in unspecified fields of a project file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-22T15:00:00.000Z
CVE-2011-4038 
Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-10T19:00:00.000Z
CVE-2011-4039 
Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-10T19:00:00.000Z
CVE-2011-4040 
Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-21T11:00:00.000Z
CVE-2011-4041 
webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long string in an RPC request to TCP port 4592.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-06T20:00:00.000Z
CVE-2011-4042 
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-03T01:00:00.000Z
CVE-2011-4043 
Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-03T01:00:00.000Z
CVE-2011-4044 
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-03T01:00:00.000Z
CVE-2011-4045 
Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-03T01:00:00.000Z
CVE-2011-4046 
The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script, which allows context-dependent attackers to obtain sensitive information by examining script source code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-12T00:00:00.000Z
CVE-2011-4047 
The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-12T00:00:00.000Z
CVE-2011-4048 
The Dell KACE K2000 System Deployment Appliance has a default username and password for the read-only reporting account, which makes it easier for remote attackers to obtain sensitive information from the database by leveraging the default credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-12T00:00:00.000Z
CVE-2011-4050 
Buffer overflow in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) 9.0.0.11200 allows remote attackers to cause a denial of service via a crafted packet to TCP port 12401.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T02:00:00.000Z
CVE-2011-4051 
CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-05T11:00:00.000Z
CVE-2011-4052 
Stack-based buffer overflow in CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 allows remote attackers to execute arbitrary code via a crafted 0x15 (aka Remove File) operation for a file with a long name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-05T11:00:00.000Z
CVE-2011-4053 
Untrusted search path vulnerability in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) before 9.0.0.11291 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T15:00:00.000Z
CVE-2011-4054 
Cross-site scripting (XSS) vulnerability in login.fcc in CA SiteMinder R6 SP6 before CR7 and R12 SP3 before CR8 allows remote attackers to inject arbitrary web script or HTML via the postpreservationdata parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T11:00:00.000Z
CVE-2011-4055 
Buffer overflow in the WebClient ActiveX control in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to execute arbitrary code via a long string in a parameter associated with the location URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T00:00:00.000Z
CVE-2011-4056 
An unspecified ActiveX control in ActBar.ocx in Siemens Tecnomatix FactoryLink 6.6.1 (aka 6.6 SP1), 7.5.217 (aka 7.5 SP2), and 8.0.2.54 allows remote attackers to create or overwrite arbitrary files via the save method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-08T00:00:00.000Z
CVE-2011-4057 
Wibu-Systems AG CodeMeter Runtime 4.30c, 4.10b, and possibly other versions before 4.40 allows remote attackers to cause a denial of service (CodeMeter.exe crash) via certain crafted packets to TCP port 22350.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-13T18:00:00.000Z
CVE-2011-4060 
The runtime linker in QNX Neutrino RTOS 6.5.0 before Service Pack 1 does not properly clear the LD_DEBUG_OUTPUT and LD_DEBUG environment variables when a program is spawned from a setuid program, which allows local users to overwrite files via a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-18T01:00:00.000Z
CVE-2011-4061 
Multiple untrusted search path vulnerabilities in (1) db2rspgn and (2) kbbacf1 in IBM DB2 Express Edition 9.7, as used in the IBM Tivoli Monitoring for Databases: DB2 Agent, allow local users to gain privileges via a Trojan horse libkbb.so in the current working directory, related to the DT_RPATH ELF header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-18T01:00:00.000Z
CVE-2011-4062 
Buffer overflow in the kernel in FreeBSD 7.3 through 9.0-RC1 allows local users to cause a denial of service (panic) or possibly gain privileges via a bind system call with a long pathname for a UNIX socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-18T01:00:00.000Z
CVE-2011-4063 
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service (daemon crash) via a malformed request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-21T10:00:00.000Z
CVE-2011-4064 
Cross-site scripting (XSS) vulnerability in the setup interface in phpMyAdmin 3.4.x before 3.4.6 allows remote attackers to inject arbitrary web script or HTML via a crafted value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-01T19:00:00.000Z
CVE-2011-4066 
SQL injection vulnerability in bbs/tb.php in Gnuboard 4.33.02 and earlier allows remote attackers to execute arbitrary SQL commands via the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-04T21:00:00.000Z
CVE-2011-4068 
The check_password function in html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to bypass authentication via an empty password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T17:00:00.000Z
CVE-2011-4069 
html/admin/login.php in PacketFence before 3.0.2 allows remote attackers to conduct LDAP injection attacks and consequently bypass authentication via a crafted username.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-01T17:00:00.000Z
CVE-2011-4073 
Use-after-free vulnerability in the cryptographic helper handler functionality in Openswan 2.3.0 through 2.6.36 allows remote authenticated users to cause a denial of service (pluto IKE daemon crash) via vectors related to the (1) quick_outI1_continue and (2) quick_outI1 functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-4074 
Cross-site scripting (XSS) vulnerability in cmd.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via an _debug command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-02T17:00:00.000Z
CVE-2011-4075 
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-02T17:00:00.000Z
CVE-2011-4076 
OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.
Problem types: description: Other
Affected products: vendor: nova
product: nova
Published: 2019-11-26T03:53:58.000Z
CVE-2011-4077 
Buffer overflow in the xfs_readlink function in fs/xfs/xfs_vnodeops.c in XFS in the Linux kernel 2.6, when CONFIG_XFS_DEBUG is disabled, allows local users to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via an XFS image containing a symbolic link with a long pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4078 
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-03T15:00:00.000Z
CVE-2011-4079 
Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value in an LDIF entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-27T20:00:00.000Z
CVE-2011-4080 
The sysrq_sysctl_handler function in kernel/sysctl.c in the Linux kernel before 2.6.39 does not require the CAP_SYS_ADMIN capability to modify the dmesg_restrict value, which allows local users to bypass intended access restrictions and read the kernel ring buffer by leveraging root privileges, as demonstrated by a root user in a Linux Containers (aka LXC) environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-4081 
crypto/ghash-generic.c in the Linux kernel before 3.1 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact by triggering a failed or missing ghash_setkey function call, followed by a (1) ghash_update function call or (2) ghash_final function call, as demonstrated by a write operation on an AF_ALG socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-4082 
A local file inclusion flaw was found in the way the phpLDAPadmin before 0.9.8 processed certain values of the "Accept-Language" HTTP header. A remote attacker could use this flaw to cause a denial of service via specially-crafted request.
Problem types: description: Other
Affected products: vendor: phpldapadmin
product: phpldapadmin
Published: 2019-11-26T04:02:45.000Z
CVE-2011-4083 
The sosreport utility in the Red Hat sos package before 1.7-9 and 2.x before 2.2-17 includes (1) Certificate-based Red Hat Network private entitlement keys and the (2) private key for the entitlement in an archive of debugging information, which might allow remote attackers to obtain sensitive information by reading the archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-17T16:00:00.000Z
CVE-2011-4085 
The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method.  NOTE: this vulnerability exists because of a CVE-2010-0738 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2011-4086 
The journal_unmap_buffer function in fs/jbd2/transaction.c in the Linux kernel before 3.3.1 does not properly handle the _Delay and _Unwritten buffer head states, which allows local users to cause a denial of service (system crash) by leveraging the presence of an ext4 filesystem that was mounted with a journal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2011-4087 
The br_parse_ip_options function in net/bridge/br_netfilter.c in the Linux kernel before 2.6.39 does not properly initialize a certain data structure, which allows remote attackers to cause a denial of service by leveraging connectivity to a network interface that uses an Ethernet bridge device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-4088 
ABRT might allow attackers to obtain sensitive information from crash reports.
Problem types: description: Other
Affected products: vendor: ABRT
product: ABRT
Published: 2020-01-31T16:45:33.000Z
CVE-2011-4089 
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-16T18:00:00.000Z
CVE-2011-4090 
Serendipity before 1.6 has an XSS issue in the karma plugin which may allow privilege escalation.
Problem types: description: Cross-Site Scripting
Affected products: vendor: serendipity
product: serendipity
Published: 2019-11-26T04:09:48.000Z
CVE-2011-4091 
The libobby server in inc/server.hpp in libnet6 (aka net6) before 1.3.14 does not perform authentication before checking the user name, which allows remote attackers to obtain sensitive information such as server-usage patterns by a particular user and color preferences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T17:00:00.000Z
CVE-2011-4092 
obby (aka libobby) does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T17:00:00.000Z
CVE-2011-4093 
Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by making a large number of connections until the overflow occurs and an ID of another user is provided.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T17:00:00.000Z
CVE-2011-4094 
Jara 1.6 has a SQL injection vulnerability.
Problem types: description: SQL injection
Affected products: vendor: Jara
product: Jara
Published: 2020-01-21T14:47:04.000Z
CVE-2011-4095 
Jara 1.6 has an XSS vulnerability
Problem types: description: XSS
Affected products: vendor: Jara
product: Jara
Published: 2020-01-21T14:49:59.000Z
CVE-2011-4096 
The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-4097 
Integer overflow in the oom_badness function in mm/oom_kill.c in the Linux kernel before 3.1.8 on 64-bit platforms allows local users to cause a denial of service (memory consumption or process termination) by using a certain large amount of memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2011-4098 
The fallocate implementation in the GFS2 filesystem in the Linux kernel before 3.2 relies on the page cache, which might allow local users to cause a denial of service by preallocating blocks in certain situations involving insufficient memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-4099 
The capsh program in libcap before 2.22 does not change the current working directory when the --chroot option is specified, which allows local users to bypass the chroot restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-08T00:00:00.000Z
CVE-2011-4100 
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.3 does not initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-03T15:00:00.000Z
CVE-2011-4101 
The dissect_infiniband_common function in epan/dissectors/packet-infiniband.c in the Infiniband dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-03T15:00:00.000Z
CVE-2011-4102 
Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-03T15:00:00.000Z
CVE-2011-4103 
emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-27T01:00:00.000Z
CVE-2011-4104 
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-27T01:00:00.000Z
CVE-2011-4105 
LightDM before 1.0.6 allows local users to change ownership of arbitrary files via a symlink attack on ~/.Xauthority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-17T23:00:00.000Z
CVE-2011-4106 
TimThumb (timthumb.php) before 2.0 does not validate the entire source with the domain white list, which allows remote attackers to upload and execute arbitrary code via a URL containing a white-listed domain in the src parameter, then accessing it via a direct request to the file in the cache directory, as exploited in the wild in August 2011.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-26T16:00:00.000Z
CVE-2011-4107 
The simplexml_load_string function in the XML import plug-in (libraries/import/xml.php) in phpMyAdmin 3.4.x before 3.4.7.1 and 3.3.x before 3.3.10.5 allows remote authenticated users to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-4108 
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T01:00:00.000Z
CVE-2011-4109 
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-06T01:00:00.000Z
CVE-2011-4110 
The user_update function in security/keys/user_defined.c in the Linux kernel 2.6 allows local users to cause a denial of service (NULL pointer dereference and kernel oops) via vectors related to a user-defined key and "updating a negative key into a fully instantiated key."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-27T15:00:00.000Z
CVE-2011-4111 
Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-26T15:00:00.000Z