rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-3987 
Mozilla Firefox before 16.0 on Android assigns chrome privileges to Reader Mode pages, which allows user-assisted remote attackers to bypass intended access restrictions via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3988 
Use-after-free vulnerability in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 might allow user-assisted remote attackers to execute arbitrary code via vectors involving use of mozRequestFullScreen to enter full-screen mode, and use of the history.back method for backwards history navigation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3989 
Mozilla Firefox before 16.0, Thunderbird before 16.0, and SeaMonkey before 2.13 do not properly perform a cast of an unspecified variable during use of the instanceof operator on a JavaScript object, which allows remote attackers to execute arbitrary code or cause a denial of service (assertion failure) via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3990 
Use-after-free vulnerability in the IME State Manager implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code via unspecified vectors, related to the nsIContent::GetNameSpaceID function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3991 
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly restrict JSAPI access to the GetProperty function, which allows remote attackers to bypass the Same Origin Policy and possibly have unspecified other impact via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3992 
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 do not properly manage history data, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive POST content via vectors involving a location.hash write operation and history navigation that triggers the loading of a URL into the history object.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3993 
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 does not properly interact with failures of InstallTrigger methods, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site, related to an "XrayWrapper pollution" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3994 
Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allow remote attackers to conduct cross-site scripting (XSS) attacks via a binary plugin that uses Object.defineProperty to shadow the top object, and leverages the relationship between top.location and the location property.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3995 
The IsCSSWordSpacingSpace function in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T17:00:00.000Z
CVE-2012-3996 
TikiWiki CMS/Groupware 8.3 and earlier allows remote attackers to obtain the installation path via a direct request to (1) admin/include_calendar.php, (2) tiki-rss_error.php, or (3) tiki-watershed_service.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T19:00:00.000Z
CVE-2012-3997 
Multiple cross-site scripting (XSS) vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to inject arbitrary web script or HTML via the (1) paste_user or (2) paste_lang parameter to (a) list.php or (b) show.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T21:00:00.000Z
CVE-2012-3998 
Multiple SQL injection vulnerabilities in Sticky Notes before 0.2.27052012.5 allow remote attackers to execute arbitrary SQL commands via the (1) paste id in admin/modules/mod_pastes.php or (2) show.php, (3) user id to admin/modules/mod_users.php, (4) project to list.php, or (5) session id to show.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T21:00:00.000Z
CVE-2012-3999 
Cross-site scripting (XSS) vulnerability in admin/login.php in Sticky Notes 0.3.09062012.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T21:00:00.000Z
CVE-2012-4000 
Cross-site scripting (XSS) vulnerability in the print_textinputs_var function in editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.php in FCKeditor 2.6.7 and earlier allows remote attackers to inject arbitrary web script or HTML via textinputs array parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T21:00:00.000Z
CVE-2012-4001 
The mod_pagespeed module before 0.10.22.6 for the Apache HTTP Server does not properly verify its host name, which allows remote attackers to trigger HTTP requests to arbitrary hosts via unspecified vectors, as demonstrated by requests to intranet servers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-15T10:00:00.000Z
CVE-2012-4002 
Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-4003 
Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-4004 
Cross-site scripting (XSS) vulnerability in the Sleipnir Mobile application 2.2.0 and earlier and Sleipnir Mobile Black Edition application 2.2.0 and earlier for Android allows remote attackers to inject arbitrary web script or HTML via a crafted application that interacts with an unspecified Sleipnir Mobile function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-08T18:00:00.000Z
CVE-2012-4005 
The NHN Japan NAVER LINE application before 2.5.5 for Android does not properly handle implicit intents, which allows remote attackers to obtain sensitive message information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T19:00:00.000Z
CVE-2012-4006 
The GREE application before 1.4.0, GREE Tanken Dorirando application before 1.0.7, GREE Tsurisuta application before 1.5.0, GREE Monpura application before 1.1.1, GREE Kaizokuoukoku Columbus application before 1.3.5, GREE haconiwa application before 1.1.0, GREE Seisen Cerberus application before 1.1.0, and KDDI&GREE GREE Market application before 2.1.2 for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T20:00:00.000Z
CVE-2012-4007 
The mixi application before 4.3.0 for Android allows remote attackers to read potentially sensitive information in friends' comments via a crafted application that leverages the storage of these comments on an SD card.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T20:00:00.000Z
CVE-2012-4008 
The Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T14:00:00.000Z
CVE-2012-4009 
The WebView class in the Cybozu Live application 1.0.4 and earlier for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T14:00:00.000Z
CVE-2012-4010 
Opera before 11.60 allows remote attackers to spoof the address bar via unspecified homograph characters, a different vulnerability than CVE-2010-2660.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-30T17:00:00.000Z
CVE-2012-4011 
The Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary Java methods, and obtain sensitive information or execute arbitrary commands, via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-08T10:00:00.000Z
CVE-2012-4012 
The WebView class in the Cybozu KUNAI application before 2.0.6 for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-08T10:00:00.000Z
CVE-2012-4013 
The WebView class in the Cybozu KUNAI Browser for Remote Service application beta for Android allows remote attackers to execute arbitrary JavaScript code, and obtain sensitive information, via a crafted application that places this code into a local file associated with a file: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-14T23:00:00.000Z
CVE-2012-4014 
Unspecified vulnerability in McAfee Email Anti-virus (formerly WebShield SMTP) allows remote attackers to cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-25T10:00:00.000Z
CVE-2012-4015 
Cross-site scripting (XSS) vulnerability in the management screen in myLittleTools myLittleAdmin for SQL Server 2000 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted database entry.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-25T10:00:00.000Z
CVE-2012-4016 
The ATOK application before 1.0.4 for Android allows remote attackers to read the learning information file, and obtain sensitive input-string information, via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T10:00:00.000Z
CVE-2012-4017 
The jigbrowser+ application before 1.5.0 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T10:00:00.000Z
CVE-2012-4018 
Cross-site scripting (XSS) vulnerability in Final Beta Laboratory MyWebSearch before 1.23 allows remote attackers to inject arbitrary web script or HTML via the keywords parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-05T10:00:00.000Z
CVE-2012-4019 
Cross-site scripting (XSS) vulnerability in tokyo_bbs.cgi in Come on Girls Interface (CGI) Tokyo BBS allows remote attackers to inject arbitrary web script or HTML via vectors related to the error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-26T10:00:00.000Z
CVE-2012-4020 
MosP kintai kanri before 4.1.0 does not enforce privilege requirements, which allows remote authenticated users to read other users' information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-08T11:00:00.000Z
CVE-2012-4021 
MosP kintai kanri before 4.1.0 does not properly perform authentication, which allows remote authenticated users to impersonate arbitrary user accounts, and consequently obtain sensitive information or modify settings, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-08T11:00:00.000Z
CVE-2012-4022 
Pebble before 2.6.4 allows remote attackers to trigger loss of blog-entry viewability via a crafted comment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-08T11:00:00.000Z
CVE-2012-4023 
CRLF injection vulnerability in Pebble before 2.6.4 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-08T11:00:00.000Z
CVE-2012-4024 
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option).  NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-19T19:00:00.000Z
CVE-2012-4025 
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-19T19:00:00.000Z
CVE-2012-4026 
The Johnson Controls Pegasys P2000 server with software before 3.11 allows remote attackers to trigger false alerts via crafted packets to TCP port 41013 (aka the upload port), a different vulnerability than CVE-2012-2607.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T17:00:00.000Z
CVE-2012-4027 
Directory traversal vulnerability in Tridium Niagara AX Framework allows remote attackers to read files outside of the intended images, nav, and px folders by leveraging incorrect permissions, as demonstrated by reading the config.bog file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T19:00:00.000Z
CVE-2012-4028 
Tridium Niagara AX Framework does not properly store credential data, which allows context-dependent attackers to bypass intended access restrictions by using the stored information for authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-16T19:00:00.000Z
CVE-2012-4029 
Cross-site scripting (XSS) vulnerability in main/dropbox/index.php in Chamilo LMS before 1.8.8.6 allows remote attackers to inject arbitrary web script or HTML via the category_name parameter in an addsentcategory action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-08T17:44:19.000Z
CVE-2012-4030 
Chamilo before 1.8.8.6 does not adequately handle user supplied input by the index.php script, which could allow remote attackers to delete arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T16:58:55.000Z
CVE-2012-4031 
Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) langid cookie to port 85.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-17T21:00:00.000Z
CVE-2012-4032 
Open redirect vulnerability in the login page in WebsitePanel before 1.2.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in ReturnUrl to Default.aspx.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-17T21:00:00.000Z
CVE-2012-4033 
Multiple unspecified vulnerabilities in the Zingiri Web Shop plugin before 2.4.0 for WordPress have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-18T18:00:00.000Z
CVE-2012-4034 
Multiple SQL injection vulnerabilities in PBBoard 2.1.4 allow remote attackers to execute arbitrary SQL commands via the (1) username parameter to the send page, (2) email parameter to the forget page, (3) password parameter to the forum_archive page, (4) section parameter to the management page, (5) section_id parameter to the managementreply page, (6) member_id parameter to the new_password page, or (7) subjectid parameter to the tags page to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-12T00:00:00.000Z
CVE-2012-4035 
The new_password page in PBBoard 2.1.4 allows remote attackers to change the password of arbitrary user accounts via the member_id and new_password parameters to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-12T00:00:00.000Z
CVE-2012-4036 
Unrestricted file upload vulnerability in admin.php in PBBoard 2.1.4 allows remote administrators to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the addons directory.  NOTE: this vulnerability can be leveraged by remote attackers using CVE-2012-1216.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-4037 
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) created by, or (3) name field in a torrent file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-15T20:00:00.000Z
CVE-2012-4043 
Cross-site scripting (XSS) vulnerability in global-protect/login.esp in Palo Alto Networks Global Protect Portal, Global Protect Gateway, and SSL VPN portals 3.1.x through 3.1.11 and 4.0.x through 4.0.5 allows remote attackers to inject arbitrary web script or HTML via the inputStr parameter in a Login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T19:00:00.000Z
CVE-2012-4045 
Multiple heap-based buffer overflows in bmp.w5s in Winamp before 5.63 build 3235 allow remote attackers to execute arbitrary code via the (1) strf chunk in BI_RGB or (2) UYVY video data in an AVI file, or (3) decompressed TechSmith Screen Capture Codec (TSCC) data in an AVI file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T17:00:00.000Z
CVE-2012-4046 
The D-Link DCS-932L camera with firmware 1.02 allows remote attackers to discover the password via a UDP broadcast packet, as demonstrated by running the D-Link Setup Wizard and reading the _paramR["P"] value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-24T18:00:00.000Z
CVE-2012-4048 
The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-24T19:00:00.000Z
CVE-2012-4049 
epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-24T19:00:00.000Z
CVE-2012-4050 
Multiple unspecified vulnerabilities in Google Chrome OS before 21.0.1180.50 on the Cr-48 and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-24T19:00:00.000Z
CVE-2012-4051 
Multiple cross-site request forgery (CSRF) vulnerabilities in editAccount.html in the JAMF Software Server (JSS) interface in JAMF Casper Suite before 8.61 allow remote attackers to hijack the authentication of administrators for requests that (1) create user accounts or (2) change passwords via a Save action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-28T10:00:00.000Z
CVE-2012-4052 
Multiple cross-site scripting (XSS) vulnerabilities in Jease before 2.9, when creating a comment, allow remote attackers to inject arbitrary web script or HTML via the (1) author, (2) subject, or (3) comment parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-20T20:00:00.000Z
CVE-2012-4053 
Cross-site request forgery (CSRF) vulnerability in eZOE flash player in eZ Publish 4.1 through 4.6 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T19:00:00.000Z
CVE-2012-4054 
Buffer overflow in the readfile function in CPE17 Autorun Killer 1.7.1 and earlier allows physically proximate attackers to execute arbitrary code via a crafted inf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T21:00:00.000Z
CVE-2012-4055 
SQL injection vulnerability in index2.php in Uiga Fan Club allows remote attackers to execute arbitrary SQL commands via the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T21:00:00.000Z
CVE-2012-4056 
SQL injection vulnerability in index2.php in Uiga Personal Portal allows remote attackers to execute arbitrary SQL commands via the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T21:00:00.000Z
CVE-2012-4057 
Buffer overflow in the Player in Remote-Anything 5.60.15 allows remote attackers to execute arbitrary code via a crafted flm file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T21:00:00.000Z
CVE-2012-4058 
Cross-site scripting (XSS) vulnerability in SocketMail Pro 2.2.9 allows remote attackers to inject arbitrary web script or HTML via the subject of an email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T21:00:00.000Z