rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-3315 
The Java servlets in the management console in IBM Tivoli Federated Identity Manager (TFIM) through 6.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE security constraints, and obtain sensitive information related to (1) federation metadata or (2) a web plugin configuration template, via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-08T11:00:00.000Z
CVE-2012-3316 
Cross-site scripting (XSS) vulnerability in the Tivoli Process Automation Engine (TPAE) in IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-20T11:00:00.000Z
CVE-2012-3317 
IBM WebSphere Message Broker 6.1 before 6.1.0.11, 7.0 before 7.0.0.5, and 8.0 before 8.0.0.2 has incorrect ownership of certain uninstaller Java Runtime Environment (JRE) files, which might allow local users to gain privileges by leveraging access to uid 501 or gid 300.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-3319 
IBM Rational Business Developer 8.x before 8.0.1.4 allows remote attackers to obtain potentially sensitive information via a connection to a web service created with the Rational Business Developer product.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-01T18:00:00.000Z
CVE-2012-3321 
IBM SmartCloud Control Desk 7.5 allows remote authenticated users to bypass intended access restrictions via vectors involving an expired password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-20T11:00:00.000Z
CVE-2012-3322 
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a display name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-20T11:00:00.000Z
CVE-2012-3323 
IBM Maximo Asset Management 6.2 before 6.2.8, 7.1 before 7.1.1.12, and 7.5 before 7.5.0.3 allows remote attackers to gain privileges via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-01T10:00:00.000Z
CVE-2012-3324 
Directory traversal vulnerability in the UTL_FILE module in IBM DB2 and DB2 Connect 10.1 before FP1 on Windows allows remote authenticated users to modify, delete, or read arbitrary files via a pathname in the file field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-25T20:00:00.000Z
CVE-2012-3325 
IBM WebSphere Application Server (WAS) 6.1.x before 6.1.0.45, 7.0.x before 7.0.0.25, 8.0.x before 8.0.0.5, and 8.5.x Full Profile before 8.5.0.1, when the PM44303 fix is installed, does not properly validate credentials, which allows remote authenticated users to obtain administrative access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-30T22:00:00.000Z
CVE-2012-3326 
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-10T17:00:00.000Z
CVE-2012-3327 
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-20T11:00:00.000Z
CVE-2012-3328 
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1, Maximo Asset Management Essentials 7.1, Tivoli Asset Management for IT 7.1 and 7.2, Tivoli Service Request Manager 7.1 and 7.2, and Change and Configuration Management Database (CCMDB) 7.1 and 7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden frame footer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-20T11:00:00.000Z
CVE-2012-3329 
IBM Advanced Settings Utility (ASU) through 3.62 and 3.70 through 9.21 and Bootable Media Creator (BoMC) through 2.30 and 3.00 through 9.21 on Linux allow local users to overwrite arbitrary files via a symlink attack on a (1) temporary file or (2) log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-19T11:00:00.000Z
CVE-2012-3330 
The proxy server in IBM WebSphere Application Server 7.0 before 7.0.0.27, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, and WebSphere Virtual Enterprise, allows remote attackers to cause a denial of service (daemon outage) via a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-14T11:00:00.000Z
CVE-2012-3331 
IBM Sametime allows remote attackers to obtain sensitive information from the Sametime Log database via a direct request to STLOG.NSF. IBM X-Force ID: 78048.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-02-08T23:00:00.000Z
CVE-2012-3333 
CRLF injection vulnerability in IBM Maximo Asset Management 7.x before 7.5.0.6 and SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter in a URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-26T10:00:00.000Z
CVE-2012-3334 
Stack-based buffer overflow in IBM Informix Dynamic Server (IDS) 11.50 before 11.50.xC9W2 and 11.70 before 11.70.xC5 allows remote authenticated users to execute arbitrary code via crafted arguments in a SET COLLATION statement.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-25T20:00:00.000Z
CVE-2012-3336 
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to multiple scripts, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 78282.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: InfoSphere Guardium
Published: 2020-09-01T15:39:02.106Z
CVE-2012-3337 
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing &quot;dot dot&quot; sequences (/../) to download arbitrary files on the system. IBM X-Force ID: 78284.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Guardium
Published: 2020-09-01T15:41:22.011Z
CVE-2012-3338 
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 could allow a remote attacker to bypass security restrictions, caused by improper restrictions on the create new user account functionality. An attacker could exploit this vulnerability to create unprivileged user accounts. IBM X-Force ID: 78286.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Guardium
Published: 2020-09-01T16:08:58.750Z
CVE-2012-3340 
IBM InfoSphere Guardium 8.0, 8.01, and 8.2 is vulnerable to XML external entity injection, caused by improper validation of user-supplied input. A remote authenticated attacker could exploit this vulnerability to obtain sensitive information. IBM X-Force ID: 78291.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: InfoSphere Guardium
Published: 2020-09-01T16:10:01.232Z
CVE-2012-3341 
IBM InfoSphere Guardium 7.0, 8.0, 8.01, and 8.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. IBM X-Force ID: 78294.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: InfoSphere Guardium
Published: 2020-09-01T16:11:09.226Z
CVE-2012-3342 
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-02T00:00:00.000Z
CVE-2012-3343 
Cross-site request forgery (CSRF) vulnerability in Microdasys before 3.5.1-B708, as used in Bloxx Web Filtering before 5.0.14 and other products, allows remote attackers to hijack the authentication of arbitrary users for requests that trigger error pages containing XSS sequences, a different vulnerability than CVE-2012-2564.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-09T00:00:00.000Z
CVE-2012-3345 
ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-15T14:00:00.000Z
CVE-2012-3347 
AutoFORM PDM Archive before 7.0 implements user accounts in a way that allows for JMX Console authentication, which allows remote authenticated users to bypass intended access restrictions via the /jmx-console URI, and then upload and execute arbitrary JSP code via a JBoss remote-deployment mechanism, a different vulnerability than CVE-2012-1828.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-13T19:00:00.000Z
CVE-2012-3350 
SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remote attackers to execute arbitrary SQL commands via the Referer HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T21:00:00.000Z
CVE-2012-3351 
Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video JW Player through 5.10.2295 allow remote attackers to inject arbitrary web script or HTML via the (1) link, (2) logo.link, or (3) aboutlink parameter, or a nested URI scheme name for (4) javascript, (5) asfunction, or (6) vbscript.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-20T17:52:01.000Z
CVE-2012-3353 
The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader
Problem types: description: Content Loading Vulnerability
Affected products: vendor: Apache Software Foundation
product: Apache Sling
Published: 2018-01-08T21:00:00.000Z
CVE-2012-3354 
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-20T00:00:00.000Z
CVE-2012-3355 
(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-17T21:00:00.000Z
CVE-2012-3356 
The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T16:00:00.000Z
CVE-2012-3357 
The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T16:00:00.000Z
CVE-2012-3358 
Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-18T23:00:00.000Z
CVE-2012-3359 
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie.  NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-30T00:00:00.000Z
CVE-2012-3360 
Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T16:00:00.000Z
CVE-2012-3361 
virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T16:00:00.000Z
CVE-2012-3362 
Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T20:00:00.000Z
CVE-2012-3363 
Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T17:00:00.000Z
CVE-2012-3364 
Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-22T23:00:00.000Z
CVE-2012-3365 
The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-20T10:00:00.000Z
CVE-2012-3366 
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2012-3367 
Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T20:00:00.000Z
CVE-2012-3368 
Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in dtach.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T21:00:00.000Z
CVE-2012-3369 
The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-05T23:11:00.000Z
CVE-2012-3370 
The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-05T23:11:00.000Z
CVE-2012-3371 
The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-17T21:00:00.000Z
CVE-2012-3372 
The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities.  NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-09T10:00:00.000Z
CVE-2012-3373 
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T19:00:00.000Z
CVE-2012-3374 
Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-07T10:00:00.000Z
CVE-2012-3375 
The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3376 
DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T19:00:00.000Z
CVE-2012-3377 
Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T21:00:00.000Z
CVE-2012-3378 
The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in /tmp/at-spi2.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T18:00:00.000Z
CVE-2012-3380 
Directory traversal vulnerability in naxsi-ui/nx_extract.py in the Naxsi module before 0.46-1 for Nginx allows local users to read arbitrary files via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T18:00:00.000Z
CVE-2012-3381 
sfcb in sblim-sfcb places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-17T00:00:00.000Z
CVE-2012-3382 
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T21:00:00.000Z
CVE-2012-3383 
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T17:00:00.000Z