rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-4643 
Multiple directory traversal vulnerabilities in Splunk 4.x before 4.2.5 allow remote authenticated users to read arbitrary files via a .. (dot dot) in a URI to (1) Splunk Web or (2) the Splunkd HTTP Server, aka SPL-45243.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-03T11:00:00.000Z
CVE-2011-4644 
Splunk 4.2.5 and earlier, when a Free license is selected, enables potentially undesirable functionality within an environment that intentionally does not support authentication, which allows remote attackers to (1) read arbitrary files via a management-console session that leverages the ability to create crafted data sources, or (2) execute management commands via an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-03T11:00:00.000Z
CVE-2011-4646 
SQL injection vulnerability in wp-postratings.php in the WP-PostRatings plugin 1.50, 1.61, and probably other versions before 1.62 for WordPress allows remote authenticated users with the Author role to execute arbitrary SQL commands via the id attribute of the ratings shortcode when creating a post.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T19:00:00.000Z
CVE-2011-4647 
Multiple cross-site scripting (XSS) vulnerabilities in the story creation feature in Geeklog 1.8.0 allow remote attackers to inject arbitrary web script or HTML via the (1) code or (2) raw BBcode tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-30T19:00:00.000Z
CVE-2011-4650 
Cisco Data Center Network Manager is affected by Excessive Logging During a TCP Flood on Java Ports. If the size of server.log becomes very big because of too much logging by the DCNM server, then the CPU utilization increases. Known Affected Releases: 5.2(1). Known Fixed Releases: 6.0(0)SL1(0.14) 5.2(2.73)S0. Product identification: CSCtt15295.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-08-07T06:00:00.000Z
CVE-2011-4659 
Cisco TelePresence Software before TE 4.1.1 on the Cisco IP Video Phone E20 has a default password for the root account after an upgrade to TE 4.1.0, which makes it easier for remote attackers to modify the configuration via an SSH session, aka Bug ID CSCtw69889, a different vulnerability than CVE-2011-2555.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T15:00:00.000Z
CVE-2011-4661 
A memory leak vulnerability exists in Cisco IOS before 15.2(1)T due to a memory leak in the HTTP PROXY Server process (aka CSCtu52820), when configured with Cisco ISR Web Security with Cisco ScanSafe and User Authenticaiton NTLM configured.
Problem types: description: memory leak
Affected products: vendor: Cisco
product: IOS
Published: 2020-02-12T16:43:39.000Z
CVE-2011-4667 
The encryption library in Cisco IOS Software 15.2(1)T, 15.2(1)T1, and 15.2(2)T, Cisco NX-OS in Cisco MDS 9222i Multiservice Modular Switch, Cisco MDS 9000 18/4-Port Multiservice Module, and Cisco MDS 9000 Storage Services Node module before 5.2(6), and Cisco IOS in Cisco VPN Services Port Adaptor for Catalyst 6500 12.2(33)SXI, and 12.2(33)SXJ when IP Security (aka IPSec) is used, allows remote attackers to obtain unencrypted packets from encrypted sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-25T21:00:00.000Z
CVE-2011-4668 
IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote attackers to execute arbitrary code via vectors related to an unspecified CGI program used with the Apache HTTP Server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T11:00:00.000Z
CVE-2011-4669 
SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T16:00:00.000Z
CVE-2011-4670 
Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) viewname parameter in a CalendarAjax action, (2) activity_mode parameter in a DetailView action, (3) contact_id and (4) parent_id parameters in an EditView action, (5) day, (6) month, (7) subtab, (8) view, and (9) viewOption parameters in the index action, and (10) start parameter in the ListView action to the Calendar module; (11) return_action and (12) return_module parameters in the EditView action, and (13) query parameter in an index action to the Campaigns module; (14) return_url and (15) workflow_id parameters in an editworkflow action to the com_vtiger_workflow module; (16) display_view parameter in an index action to the Dashboard module; (17) closingdate_end, (18) closingdate_start, (19) date_closed, (20) owner, (21) leadsource, (22) sales_stage, and (23) type parameters in a ListView action to the Potentials module; (24) folderid parameter in a SaveandRun action to the Reports module; (25) returnaction and (26) groupId parameters in a createnewgroup action, (27) mode and (28) parent parameters in a createrole action, (29) src_module in a ModuleManager action, (30) mode and (31) profile_id parameters in a profilePrivileges action, and (32) roleid parameter in a RoleDetailView to the Settings module; and (33) action parameter to the Home module and (34) module parameter to phprint.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T16:00:00.000Z
CVE-2011-4671 
SQL injection vulnerability in adrotate/adrotate-out.php in the AdRotate plugin 3.6.6, and other versions before 3.6.8, for WordPress allows remote attackers to execute arbitrary SQL commands via the track parameter (aka redirect URL).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T18:00:00.000Z
CVE-2011-4672 
Multiple SQL injection vulnerabilities in Valid tiny-erp 1.6 and earlier allow remote attackers to execute arbitrary SQL commands via the SearchField parameter in a search action to (1) _partner_list.php, (2) proioncategory_list.php, (3) _rantevou_list.php, (4) syncategory_list.php, (5) synallasomenos_list.php, (6) ypelaton_list.php, and (7) yproion_list.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T18:00:00.000Z
CVE-2011-4673 
SQL injection vulnerability in modules/sharedaddy.php in the Jetpack plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T18:00:00.000Z
CVE-2011-4674 
SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-02T18:00:00.000Z
CVE-2011-4675 
The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in strings received from the network, which might allow remote attackers to conduct absolute path traversal attacks and overwrite arbitrary files via a ~ in a pathname that is used for a file transfer in an Internet game, a different vulnerability than CVE-2011-1932.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-05T11:00:00.000Z
CVE-2011-4677 
One Click Orgs before 1.2.3 does not have an off autocomplete attribute for authentication fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-06T11:00:00.000Z
CVE-2011-4678 
The password reset feature in One Click Orgs before 1.2.3 generates different error messages for failed reset attempts depending on whether the e-mail address is registered, which allows remote attackers to enumerate user accounts via a series of requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-06T11:00:00.000Z
CVE-2011-4679 
vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4680 
Multiple cross-site scripting (XSS) vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4681 
Opera before 11.60 does not properly consider the number of . (dot) characters that conventionally exist in domain names of different top-level domains, which allows remote attackers to bypass the Same Origin Policy by leveraging access to a different domain name in the same top-level domain, as demonstrated by the .no or .uk domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4682 
The JavaScript engine in Opera before 11.60 does not properly implement the in operator, which allows remote attackers to bypass the Same Origin Policy via vectors related to variables on different web sites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4683 
Unspecified vulnerability in Opera before 11.60 has unknown impact and attack vectors, related to a "moderately severe issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4684 
Opera before 11.60 does not properly handle certificate revocation, which has unspecified impact and remote attack vectors related to "corner cases."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4685 
Dragonfly in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unspecified content on a web page, as demonstrated by forbes.com.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4686 
Unspecified vulnerability in the Web Workers implementation in Opera before 11.60 allows remote attackers to cause a denial of service (application crash) via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4687 
Opera before 11.60 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified content on a web page, as demonstrated by a page under the cisco.com home page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4688 
Mozilla Firefox 8.0.1 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4689 
Microsoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4690 
Opera 11.60 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4691 
Google Chrome 15.0.874.121 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4692 
WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading, which makes it easier for remote attackers to determine whether an image exists in the browser cache via crafted JavaScript code, as demonstrated by visipisi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T19:00:00.000Z
CVE-2011-4693 
Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the first of two vulnerabilities exploited by the Intevydis vd_adobe_fp module in VulnDisco Step Ahead (SA).  NOTE: as of 20111207, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T20:00:00.000Z
CVE-2011-4694 
Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the second of two vulnerabilities exploited by the Intevydis vd_adobe_fp module in VulnDisco Step Ahead (SA).  NOTE: as of 20111207, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T20:00:00.000Z
CVE-2011-4695 
Unspecified vulnerability in Microsoft Windows 7 SP1, when Java is installed, allows local users to bypass Internet Explorer sandbox restrictions and gain privileges via unknown vectors, as demonstrated by the White Phosphorus wp_ie_sandbox_escape module for Immunity CANVAS.  NOTE: as of 20111207, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-07T20:00:00.000Z
CVE-2011-4696 
Directory traversal vulnerability in Eye-Fi Helper before 3.4.23 allows man-in-the-middle attackers to create arbitrary files via a .. (dot dot) in the filesignature in a GetPhotoStatus request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-03-03T16:00:00.000Z
CVE-2011-4697 
The Xiaomi MiTalk Messenger (com.xiaomi.channel) application before 2.1.320 for Android does not properly protect data, which allows remote attackers to read or modify messaging information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4698 
The AndroidAppTools Easy Filter (com.phoneblocker.android) application 1.1 and 1.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS messages and call records via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4699 
The Ubermedia Twidroyd Legacy (com.twidroydlegacy) application 4.3.11 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4700 
The UberMedia UberSocial (com.twidroid) application 7.x before 7.2.4 for Android does not properly protect data, which allows remote attackers to read or modify Twitter information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4701 
The CallConfirm (jp.gr.java_conf.ofnhwx.callconfirm) application 2.0.0 for Android does not properly protect data, which allows remote attackers to read or modify allow/block lists via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4702 
The Nimbuzz (com.nimbuzz) application 2.0.8 and 2.0.10 for Android does not properly protect data, which allows remote attackers to read or modify a contact list via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4703 
The Limit My Call (com.limited.call.view) application 2.11 for Android does not properly protect data, which allows remote attackers to read or modify call logs and a contact list via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4704 
The Voxofon (com.voxofon) application before 2.5.2 for Android does not properly protect data, which allows remote attackers to read or modify SMS information via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4705 
The Ming Blacklist Free (vc.software.blacklist) application 1.8.1 and 1.9.2.1 for Android does not properly protect data, which allows remote attackers to read or modify blacklists and a contact list via a crafted application that launches a "data-flow attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-25T02:00:00.000Z
CVE-2011-4707 
Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4708 
Cross-site scripting (XSS) vulnerability in IBM Rational Asset Manager before 7.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4709 
Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter to admin_index.php, or the (2) return and (3) search parameters to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4710 
Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the (1) pixie_user parameter and (2) Referer HTTP header in a request to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4711 
Multiple directory traversal vulnerabilities in namazu.cgi in Namazu before 2.0.16 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) result parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4712 
Directory traversal vulnerability in Oxide WebServer allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in an HTTP request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4713 
Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the _ID parameter to (1) catalog/shopping_cart.php or (2) catalog/content.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4714 
Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files via a \.. (backslash dot dot) in the URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4715 
Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4716 
Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-08T19:00:00.000Z
CVE-2011-4717 
Directory traversal vulnerability in zFTPServer Suite 6.0.0.52 allows remote authenticated users to delete arbitrary directories via a crafted RMD (aka rmdir) command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-20T11:00:00.000Z
CVE-2011-4718 
Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a session ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-13T01:00:00.000Z
CVE-2011-4719 
Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-09T20:00:00.000Z
CVE-2011-4720 
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-28T00:00:00.000Z
CVE-2011-4722 
Directory traversal vulnerability in the TFTP Server 1.0.0.24 in Ipswitch WhatsUp Gold allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename field of an RRQ operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-28T02:00:00.000Z
CVE-2011-4723 
The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-20T11:00:00.000Z
CVE-2011-4725 
Multiple SQL injection vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to execute arbitrary SQL commands via crafted input to a PHP script, as demonstrated by login_up.php3 and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T11:00:00.000Z