rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-0821 
Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0819.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T19:00:00.000Z
CVE-2012-0822 
Cross-site scripting (XSS) vulnerability in Joomla! 1.6 and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0820.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T19:00:00.000Z
CVE-2012-0823 
VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-23T19:00:00.000Z
CVE-2012-0824 
gnusound 0.7.5 has format string issue
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: gnusound
product: gnusound
Published: 2019-11-19T15:47:26.000Z
CVE-2012-0825 
Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2012-0826 
Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2012-0827 
The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T22:00:00.000Z
CVE-2012-0828 
Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) or execute arbitrary code via a UTF-8 line from server containing characters outside of the Basic Multilingual Plane (BMP).
Problem types: description: Heap-based buffer overflow by processing UTF-8 line from server containing characters outside BMP
Affected products: vendor: xchat
product: Xchat-WDK
vendor: xchat
product: xchat
Published: 2020-02-21T17:20:43.000Z
CVE-2012-0829 
Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-14T00:00:00.000Z
CVE-2012-0830 
The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-06T20:00:00.000Z
CVE-2012-0831 
PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-10T20:00:00.000Z
CVE-2012-0833 
The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2012-0834 
Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-11T02:00:00.000Z
CVE-2012-0835 
Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain sensitive information via unknown vectors related to "administrator."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T19:00:00.000Z
CVE-2012-0836 
Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 allows attackers to read the error log via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T19:00:00.000Z
CVE-2012-0837 
Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-06T19:00:00.000Z
CVE-2012-0838 
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-02T22:00:00.000Z
CVE-2012-0839 
OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-08T20:00:00.000Z
CVE-2012-0840 
tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-10T19:00:00.000Z
CVE-2012-0841 
libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-21T02:00:00.000Z
CVE-2012-0842 
surf: cookie jar has read access from other local user
Problem types: description: info leak
Affected products: vendor: surf
product: surf
Published: 2019-11-19T14:53:56.000Z
CVE-2012-0843 
uzbl: Information disclosure via world-readable cookies storage file
Problem types: description: world-readable cookie file
Affected products: vendor: uzbl
product: uzbl
Published: 2019-11-19T15:56:52.000Z
CVE-2012-0844 
Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: netsurf
product: netsurf
Published: 2020-02-21T17:42:21.000Z
CVE-2012-0845 
SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-05T21:00:00.000Z
CVE-2012-0846 
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-08T20:00:00.000Z
CVE-2012-0847 
Heap-based buffer overflow in the avfilter_filter_samples function in libavfilter/avfilter.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T19:00:00.000Z
CVE-2012-0848 
Heap-based buffer overflow in the ws_snd_decode_frame function in libavcodec/ws-snd1.c in FFmpeg 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file, related to an incorrect calculation, aka "wrong samples count."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T19:00:00.000Z
CVE-2012-0849 
Integer overflow in the ff_j2k_dwt_init function in libavcodec/j2k_dwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-0850 
The sbr_qmf_synthesis function in libavcodec/aacsbr.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted mpg file that triggers memory corruption involving the v_off variable, probably a buffer underflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T19:00:00.000Z
CVE-2012-0851 
The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T18:00:00.000Z
CVE-2012-0852 
The adpcm_decode_frame function in adpcm.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an ADPCM file with the number of channels not equal to two.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T18:00:00.000Z
CVE-2012-0853 
The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec in FFmpeg 0.7.x before 0.7.12, and 0.8.x before 0.8.11; and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (infinite loop and crash) and possibly execute arbitrary code via a large component count in an Atrac 3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T18:00:00.000Z
CVE-2012-0854 
The dpcm_decode_frame function in libavcodec/dpcm.c in FFmpeg before 0.9.1 does not use the proper pointer after an audio API change, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors, which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T19:00:00.000Z
CVE-2012-0855 
Heap-based buffer overflow in the get_sot function in the J2K decoder (j2k.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to the curtileno variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-0856 
Heap-based buffer overflow in the MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.9.1, when the lowres option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted H263 media file.  NOTE: this vulnerability exists because of a regression error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T19:00:00.000Z
CVE-2012-0857 
Multiple buffer overflows in the get_qcx function in the J2K decoder (j2kdec.c) in libavcode in FFmpeg before 0.9.1 allow remote attackers to cause a denial of service (application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T19:00:00.000Z
CVE-2012-0858 
The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Shorten file, related to an "invalid free".
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T18:00:00.000Z
CVE-2012-0859 
The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T18:00:00.000Z
CVE-2012-0860 
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2012-0861 
The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2012-0862 
builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-04T20:00:00.000Z
CVE-2012-0863 
Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-30T14:00:00.000Z
CVE-2012-0864 
Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-02T14:00:00.000Z
CVE-2012-0865 
Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-21T00:00:00.000Z
CVE-2012-0866 
CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-18T23:00:00.000Z
CVE-2012-0867 
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-18T23:00:00.000Z
CVE-2012-0868 
CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-18T23:00:00.000Z
CVE-2012-0869 
Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-25T23:00:00.000Z
CVE-2012-0870 
Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-23T11:00:00.000Z
CVE-2012-0871 
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-18T14:00:00.000Z
CVE-2012-0872 
Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField, (2) email, (3) form_name, (4) password, (5) realname, (6) repeatPassword, or (7) username parameters to Oxwall/join; (8) captcha, (9) email, (10) form_name, (11) from, or (12) subject parameters to Oxwall/contact; (13) tag parameter to Oxwall/blogs/browse-by-tag; or (14) PATH_INFO to Oxwall/photo/viewlist/tagged, (15) Oxwall/photo/viewlist, or (16) Oxwall/video/viewlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-19T19:00:00.000Z
CVE-2012-0873 
Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-02-23T19:00:00.000Z
CVE-2012-0874 
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors.  NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-05T23:11:00.000Z
CVE-2012-0875 
SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-04T19:00:00.000Z
CVE-2012-0876 
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T19:00:00.000Z
CVE-2012-0877 
PyXML: Hash table collisions CPU usage Denial of Service
Problem types: description: table collisions CPU usage DoS
Affected products: vendor: PyXML
product: PyXML
Published: 2019-11-22T16:15:26.000Z
CVE-2012-0878 
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-01T19:00:00.000Z
CVE-2012-0879 
The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-17T10:00:00.000Z
CVE-2012-0880 
Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table collisions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-08T21:00:00.000Z
CVE-2012-0881 
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-30T16:00:00.000Z
CVE-2012-0882 
Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17.  NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.  NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-21T02:00:00.000Z