rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-3453 
The WW8ListManager::WW8ListManager function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 does not properly handle an unspecified number of list levels in user-defined list styles in WW8 data in a Microsoft Word document, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted .DOC file that triggers an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-28T21:13:00.000Z
CVE-2010-3454 
Multiple off-by-one errors in the WW8DopTypography::ReadFromMem function in oowriter in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted typography information in a Microsoft Word .DOC file that triggers an out-of-bounds write.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-28T21:13:00.000Z
CVE-2010-3455 
Cross-site scripting (XSS) vulnerability in index.php in AChecker 1.0 allows remote attackers to inject arbitrary web script or HTML via the uri parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3456 
Directory traversal vulnerability in download.php in EnergyScripts (ES) Simple Download 1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3457 
Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) fields[website] parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or (2) send-email[recipient] parameter to about/.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3458 
SQL injection vulnerability in lib/toolkit/events/event.section.php in Symphony CMS 2.0.7 and 2.1.1 allows remote attackers to execute arbitrary SQL commands via the send-email[recipient] parameter to about/.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3459 
Cross-site scripting (XSS) vulnerability in the Ajax WebMail interface in AXIGEN Mail Server before 7.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3460 
Directory traversal vulnerability in the HTTP interface in AXIGEN Mail Server 7.4.1 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3461 
SQL injection vulnerability in the Publisher module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL commands via the artid parameter in a printarticle action to mod.php, a different vector than CVE-2007-3394.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3462 
Cross-site scripting (XSS) vulnerability in backend/plugin/Registration/index.php in Mollify 1.6, 1.6.5.5, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the confirm parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3463 
Cross-site scripting (XSS) vulnerability in modules/search/search.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to inject arbitrary web script or HTML via the search parameter to search.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3464 
Cross-site request forgery (CSRF) vulnerability in admin/manager_users.class.php in SantaFox 2.02, and possibly earlier, allows remote attackers to hijack the authentication of administrators for requests, as demonstrated by adding administrative users via the save_admin action to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3465 
Multiple cross-site scripting (XSS) vulnerabilities in XSE Shopping Cart 1.5.2.1 and 1.5.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to Default.aspx and the (2) type parameter to SearchResults.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3466 
Cross-site scripting (XSS) vulnerability in index.php in the hosted_signup module in NetArt Media iBoutique.MALL 1.2 allows remote attackers to inject arbitrary web script or HTML via the tmpl parameter.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3467 
SQL injection vulnerability in modules/sections/index.php in E-Xoopport Samsara 3.1 and earlier, when the Tutorial module is enabled, allows remote attackers to execute arbitrary SQL commands via the secid parameter in a listarticles action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-17T19:00:00.000Z
CVE-2010-3468 
Directory traversal vulnerability in fileManager.cfc in Mura CMS 5.1 before 5.1.498 and 5.2 before 5.2.2809, and Sava CMS 5 through 5.2, allows remote attackers to read arbitrary files via a .. (dot dot) in the FILEID parameter to the default URI under tasks/render/file/.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-29T16:00:00.000Z
CVE-2010-3470 
Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 and 4.0.2.x before 4.0.2.7-P8AE-FP007 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2010-3471 
Session fixation vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 4.0.2.x before 4.0.2.7-P8AE-FP007 allows remote attackers to hijack web sessions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2010-3472 
Multiple cross-site scripting (XSS) vulnerabilities in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2010-3473 
Open redirect vulnerability in the Workplace (aka WP) component in IBM FileNet P8 Application Engine (P8AE) 3.5.1 before 3.5.1-021 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2010-3474 
IBM DB2 9.7 before FP3 does not perform the expected drops or invalidations of dependent functions upon a loss of privileges by the functions' owners, which allows remote authenticated users to bypass intended access restrictions via calls to these functions, a different vulnerability than CVE-2009-3471.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2010-3475 
IBM DB2 9.7 before FP3 does not properly enforce privilege requirements for execution of entries in the dynamic SQL cache, which allows remote authenticated users to bypass intended access restrictions by leveraging the cache to execute an UPDATE statement contained in a compiled compound SQL statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2010-3476 
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-20T21:00:00.000Z
CVE-2010-3477 
The tcf_act_police_dump function in net/sched/act_police.c in the actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc4 does not properly initialize certain structure members, which allows local users to obtain potentially sensitive information from kernel memory via vectors involving a dump operation.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2942.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-21T19:00:00.000Z
CVE-2010-3479 
SQL injection vulnerability in list.php in BoutikOne 1.0 allows remote attackers to execute arbitrary SQL commands via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3480 
Directory traversal vulnerability in index.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3481 
Multiple SQL injection vulnerabilities in login.php in ApPHP PHP MicroCMS 1.0.1, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) user_name and (2) password variables, possibly related to include/classes/Login.php. NOTE: some of these details are obtained from third party information. NOTE: the password vector might not be vulnerable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3482 
Multiple SQL injection vulnerabilities in cms_write.php in Primitive CMS 1.0.9 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) title and (2) menutitle parameters. NOTE: this can be leveraged with CVE-2010-3483 to conduct attacks without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3483 
cms_write.php in Primitive CMS 1.0.9 does not properly restrict access, which allows remote attackers to gain administrative privileges via a direct request.  NOTE: this vulnerability can be leveraged to conduct cross-site scripting attacks, as demonstrated using the (1) title, (2) content, and (3) menutitle parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3484 
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3485 
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3486 
Directory traversal vulnerability in FileStorageUpload.ashx in SmarterMail 7.1.3876 allows remote attackers to read arbitrary files via a (1) ../ (dot dot slash), (2) %5C (encoded backslash), or (3) %255c (double-encoded backslash) in the name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3487 
Directory traversal vulnerability in YelloSoft Pinky 1.0 for Windows allows remote attackers to read arbitrary files via a %5C (encoded backslash) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3488 
Directory traversal vulnerability in QuickShare 1.0 allows remote attackers to read arbitrary files via a ... (triple dot) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3489 
Cross-site scripting (XSS) vulnerability in netautor/napro4/home/login2.php in CMS Digital Workroom (formerly Netautor Professional) 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the goback parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-22T19:00:00.000Z
CVE-2010-3490 
Directory traversal vulnerability in page.recordings.php in the System Recordings component in the configuration interface in FreePBX 2.8.0 and earlier allows remote authenticated administrators to create arbitrary files via a .. (dot dot) in the usersnum parameter to admin/config.php, as demonstrated by creating a .php file under the web root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-09-28T17:00:00.000Z
CVE-2010-3491 
The (1) ActiveMatrix Runtime and (2) ActiveMatrix Administrator components in TIBCO ActiveMatrix Service Grid before 2.3.1, ActiveMatrix Service Bus before 2.3.1, ActiveMatrix BusinessWorks Service Engine before 5.8.1, and ActiveMatrix Service Performance Manager before 1.3.2 do not properly handle JMX connections, which allows remote attackers to execute arbitrary code, obtain sensitive information, or cause a denial of service via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-26T18:00:00.000Z
CVE-2010-3492 
The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2010-3493 
Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function having an ENOTCONN error, a related issue to CVE-2010-3492.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2010-3494 
Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2010-3495 
Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-19T19:00:00.000Z
CVE-2010-3496 
McAfee VirusScan Enterprise 8.5i and 8.7i does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2010-3497 
Symantec Norton AntiVirus 2011 does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution. NOTE: the researcher indicates that a vendor response was received, stating that this issue "falls into the work of our Firewall and not our AV (per our methodology of layers of defense)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2010-3498 
AVG Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2010-3499 
F-Secure Anti-Virus does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution.  NOTE: the researcher indicates that a vendor response was received, stating that "the inability to catch these files are caused by lacking functionality rather than programming errors."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T10:00:00.000Z
CVE-2010-3500 
Unspecified vulnerability in the Siebel Core - Highly Interactive Client component in Oracle Siebel Suite 7.7.2.12, 7.8.2.14, 8.0.0.10, and 8.1.1.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-2405.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3501 
Unspecified vulnerability in the OID component in Oracle Fusion Middleware 10.1.2.3, 10.1.4.3, and 11.1.1.2.0 allows remote attackers to affect availability via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3502 
Unspecified vulnerability in the Siebel Core component in Oracle Siebel Suite 7.7.2.12, 7.8.2.14, 8.0.0.10, and 8.1.1.3 allows remote authenticated users to affect confidentiality via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3503 
Unspecified vulnerability in Oracle Solaris 10 and OpenSolaris allows local users to affect confidentiality and integrity via unknown vectors related to su.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3504 
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.2 allows remote attackers to affect integrity via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3505 
Unspecified vulnerability in the Agile Core component in Oracle Supply Chain Products Suite 9.3.0.2 and 9.3.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Folders, Files & Attachments, a different vulnerability than CVE-2010-4429.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T15:00:00.000Z
CVE-2010-3506 
Unspecified vulnerability in the Oracle Explorer (Sun Explorer) component in Oracle Sun Products Suite 6.4 allows local users to affect confidentiality and integrity via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3507 
Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Live Upgrade.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3508 
Unspecified vulnerability in Oracle Solaris 10 allows local users to affect confidentiality and integrity via unknown vectors related to Solaris Zones.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3509 
Unspecified vulnerability in Oracle Solaris 8, 9, and 10 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Scheduler.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3510 
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 9.0, 9.1, 9.2.3, 10.0.2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Node Manager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T15:00:00.000Z
CVE-2010-3511 
Unspecified vulnerability in Oracle OpenSolaris allows local users to affect integrity and availability via unknown vectors related to Tooltalk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3512 
Unspecified vulnerability in the Oracle iPlanet Web Server (Sun Java System Web Server) component in Oracle Sun Products Suite 7.0u8 allows remote authenticated users to affect confidentiality, related to DAV (WebDAV).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3513 
Unspecified vulnerability in Oracle Solaris 9 and 10, and OpenSolaris, allows local users to affect integrity and availability via unknown vectors related to Device Drivers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3514 
Unspecified vulnerability in the Oracle iPlanet Web Server (Sun Java System Web Server) component in Oracle Sun Products Suite 6.1 and 7.0 allows remote attackers to affect integrity via unknown vectors related to Web Container.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z
CVE-2010-3515 
Unspecified vulnerability in the Solaris component in Oracle Solaris 9 and 10, and OpenSolaris, allows local users to affect availability via unknown vectors related to Kernel/Disk Driver.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-13T23:00:00.000Z