rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-2684 
foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as packaged in Debian squeeze create temporary files insecurely, which allows local users to write over arbitrary files via a symlink attack on /tmp/foo2zjs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-10-23T18:00:00.000Z
CVE-2011-2685 
Stack-based buffer overflow in the Lotus Word Pro import filter in LibreOffice before 3.3.3 allows remote attackers to execute arbitrary code via a crafted .lwp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-21T23:00:00.000Z
CVE-2011-2686 
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.  NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-05T21:00:00.000Z
CVE-2011-2687 
Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T01:29:00.000Z
CVE-2011-2688 
SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-28T18:00:00.000Z
CVE-2011-2689 
The gfs2_fallocate function in fs/gfs2/file.c in the Linux kernel before 3.0-rc1 does not ensure that the size of a chunk allocation is a multiple of the block size, which allows local users to cause a denial of service (BUG and system crash) by arranging for all resource groups to have too little free space.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-28T22:00:00.000Z
CVE-2011-2690 
Buffer overflow in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4, when used by an application that calls the png_rgb_to_gray function but not the png_set_expand function, allows remote attackers to overwrite memory with an arbitrary amount of data, and possibly have unspecified other impact, via a crafted PNG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2691 
The png_err function in pngerror.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 makes a function call using a NULL pointer argument instead of an empty-string argument, which allows remote attackers to cause a denial of service (application crash) via a crafted PNG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2692 
The png_handle_sCAL function in pngrutil.c in libpng 1.0.x before 1.0.55, 1.2.x before 1.2.45, 1.4.x before 1.4.8, and 1.5.x before 1.5.4 does not properly handle invalid sCAL chunks, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted PNG image that triggers the reading of uninitialized memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-17T20:00:00.000Z
CVE-2011-2693 
The perf subsystem in the kernel package 2.6.32-122.el6.x86_64 in Red Hat Enterprise Linux (RHEL) 6 does not properly handle NMIs, which might allow local users to cause a denial of service (excessive log messages) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-08T10:00:00.000Z
CVE-2011-2694 
Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-29T20:00:00.000Z
CVE-2011-2695 
Multiple off-by-one errors in the ext4 subsystem in the Linux kernel before 3.0-rc5 allow local users to cause a denial of service (BUG_ON and system crash) by accessing a sparse file in extent format with a write operation involving a block number corresponding to the largest possible 32-bit unsigned integer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-28T22:00:00.000Z
CVE-2011-2696 
Integer overflow in libsndfile before 1.0.25 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PARIS Audio Format (PAF) file that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T01:29:00.000Z
CVE-2011-2697 
foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-29T20:00:00.000Z
CVE-2011-2698 
Off-by-one error in the elem_cell_id_aux function in epan/dissectors/packet-ansi_a.c in the ANSI MAP dissector in Wireshark 1.4.x before 1.4.8 and 1.6.x before 1.6.1 allows remote attackers to cause a denial of service (infinite loop) via an invalid packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-23T21:00:00.000Z
CVE-2011-2699 
The IPv6 implementation in the Linux kernel before 3.1 does not generate Fragment Identification values separately for each destination, which makes it easier for remote attackers to cause a denial of service (disrupted networking) by predicting these values and sending crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-2700 
Multiple buffer overflows in the si4713_write_econtrol_string function in drivers/media/radio/si4713-i2c.c in the Linux kernel before 2.6.39.4 on the N900 platform might allow local users to cause a denial of service or have unspecified other impact via a crafted s_ext_ctrls operation with a (1) V4L2_CID_RDS_TX_PS_NAME or (2) V4L2_CID_RDS_TX_RADIO_TEXT control ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T15:00:00.000Z
CVE-2011-2701 
The ocsp_check function in rlm_eap_tls.c in FreeRADIUS 2.1.11, when OCSP is enabled, does not properly parse replies from OCSP responders, which allows remote attackers to bypass authentication by using the EAP-TLS protocol with a revoked X.509 client certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-04T01:00:00.000Z
CVE-2011-2702 
Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S, (2) memcpy-ssse3.S, or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/, which triggers an out-of-bounds read, as demonstrated using the memcpy function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-10-27T20:00:00.000Z
CVE-2011-2703 
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-01T19:00:00.000Z
CVE-2011-2704 
Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-01T19:00:00.000Z
CVE-2011-2705 
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-05T21:00:00.000Z
CVE-2011-2706 
A Cross-Site Scripting (XSS) vulnerability exists in the reorder administrator functions in sNews 1.71.
Problem types: description: XSS
Affected products: vendor: sNews
product: sNews
Published: 2020-01-14T20:58:34.000Z
CVE-2011-2707 
The ptrace_setxregs function in arch/xtensa/kernel/ptrace.c in the Linux kernel before 3.1 does not validate user-space pointers, which allows local users to obtain sensitive information from kernel memory locations via a crafted PTRACE_SETXTREGS request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-24T23:00:00.000Z
CVE-2011-2709 
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2011-2710 
Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php, reachable through index.php; and, when Internet Explorer or Konqueror is used, (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.  NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-27T20:00:00.000Z
CVE-2011-2711 
Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-03T00:00:00.000Z
CVE-2011-2712 
Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.18, when setAutomaticMultiWindowSupport is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-29T15:00:00.000Z
CVE-2011-2713 
oowriter in OpenOffice.org 3.3.0 and LibreOffice before 3.4.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers an out-of-bounds read in the DOC sprm parser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-21T18:00:00.000Z
CVE-2011-2714 
A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display.
Problem types: description: XSS
Affected products: vendor: Drupal
product: Data-module
Published: 2020-01-14T21:17:41.000Z
CVE-2011-2715 
An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names.
Problem types: description: SQL injection
Affected products: vendor: Drupal
product: Data-module
Published: 2020-01-14T21:22:54.000Z
CVE-2011-2716 
The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T16:00:00.000Z
CVE-2011-2717 
The DHCPv6 client (dhcp6c) as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message.
Problem types: description: insufficient checking of DHCP options
Affected products: vendor: dhcpv6 project
product: dhcpv6
Published: 2019-11-27T20:58:00.000Z
CVE-2011-2718 
Multiple directory traversal vulnerabilities in the relational schema implementation in phpMyAdmin 3.4.x before 3.4.3.2 allow remote authenticated users to include and execute arbitrary local files via directory traversal sequences in an export type field, related to (1) libraries/schema/User_Schema.class.php and (2) schema_export.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-01T19:00:00.000Z
CVE-2011-2719 
libraries/auth/swekey/swekey.auth.lib.php in phpMyAdmin 3.x before 3.3.10.3 and 3.4.x before 3.4.3.2 does not properly manage sessions associated with Swekey authentication, which allows remote attackers to modify the SESSION superglobal array, other superglobal arrays, and certain swekey.auth.lib.php local variables via a crafted query string, a related issue to CVE-2011-2505.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-01T19:00:00.000Z
CVE-2011-2720 
The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-05T21:00:00.000Z
CVE-2011-2721 
Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-05T21:00:00.000Z
CVE-2011-2722 
The send_data_to_stdout function in prnt/hpijs/hpcupsfax.cpp in HP Linux Imaging and Printing (HPLIP) 3.x before 3.11.10 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hpcupsfax.out temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-05-25T20:00:00.000Z
CVE-2011-2723 
The skb_gro_header_slow function in include/linux/netdevice.h in the Linux kernel before 2.6.39.4, when Generic Receive Offload (GRO) is enabled, resets certain fields in incorrect situations, which allows remote attackers to cause a denial of service (system crash) via crafted network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T15:00:00.000Z
CVE-2011-2724 
The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T16:00:00.000Z
CVE-2011-2725 
Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-04T19:00:00.000Z
CVE-2011-2726 
An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied access, non-privileged users can still download the file attached to the comment if they know or guess its direct URL.
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: drupal core
product: drupal core
Published: 2019-11-15T16:21:51.000Z
CVE-2011-2727 
The (1) templatewrap/templatefoot.php, (2) cmsjs/plugin.js.php, and (3) cmsincludes/cms_plugin_api_link.inc.php scripts in Tribal Tribiq CMS before 5.2.7c allow remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-12-30T02:00:00.000Z
CVE-2011-2728 
The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-21T02:00:00.000Z
CVE-2011-2729 
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-15T21:00:00.000Z
CVE-2011-2730 
VMware SpringSource Spring Framework before 2.5.6.SEC03, 2.5.7.SR023, and 3.x before 3.0.6, when a container supports Expression Language (EL), evaluates EL expressions in tags twice, which allows remote attackers to obtain sensitive information via a (1) name attribute in a (a) spring:hasBindErrors tag; (2) path attribute in a (b) spring:bind or (c) spring:nestedpath tag; (3) arguments, (4) code, (5) text, (6) var, (7) scope, or (8) message attribute in a (d) spring:message or (e) spring:theme tag; or (9) var, (10) scope, or (11) value attribute in a (f) spring:transform tag, aka "Expression Language Injection."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T17:00:00.000Z
CVE-2011-2731 
Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T17:00:00.000Z
CVE-2011-2732 
CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T17:00:00.000Z
CVE-2011-2733 
EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not prevent reuse of authentication information during a session, which allows remote authenticated users to bypass intended access restrictions via vectors related to knowledge of the originally used authentication information and unspecified other session information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-18T23:00:00.000Z
CVE-2011-2735 
Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.1 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted message over TCP.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-23T21:00:00.000Z
CVE-2011-2736 
RSA enVision 4.x before 4 SP4 P3 places cleartext administrative credentials in Task Escalation e-mail messages, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to a recipient mailbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-25T14:00:00.000Z
CVE-2011-2737 
RSA enVision 3.x and 4.x before 4 SP4 P3 allows remote attackers to read arbitrary files via unspecified vectors, related to an "arbitrary file retrieval vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-08-25T14:00:00.000Z
CVE-2011-2738 
Multiple unspecified vulnerabilities in Cisco Unified Service Monitor before 8.6, as used in Unified Operations Manager before 8.6 and CiscoWorks LAN Management Solution 3.x and 4.x before 4.1; and multiple EMC Ionix products including Application Connectivity Monitor (Ionix ACM) 2.3 and earlier, Adapter for Alcatel-Lucent 5620 SAM EMS (Ionix ASAM) 3.2.0.2 and earlier, IP Management Suite (Ionix IP) 8.1.1.1 and earlier, and other Ionix products; allow remote attackers to execute arbitrary code via crafted packets to TCP port 9002, aka Bug IDs CSCtn42961 and CSCtn64922, related to a buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-17T10:00:00.000Z
CVE-2011-2739 
The file-blocking feature in EMC Documentum eRoom 7.3.x and 7.4.x before 7.4.3.g does not properly restrict the uploading and opening of files with dangerous file types, which allows remote authenticated users to execute arbitrary code via an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T23:00:00.000Z
CVE-2011-2740 
EMC RSA Key Manager (RKM) Appliance 2.7 SP1 before 2.7.1.6, when Firefox 4.x or 5.0 is used, does not properly terminate a user session upon a logout action, which makes it easier for remote attackers to execute arbitrary code by leveraging an unattended workstation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-09T23:00:00.000Z
CVE-2011-2741 
EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly implement Device Recovery and Device Identification, which might allow remote attackers to bypass intended security restrictions on a (1) previously non-registered device or (2) registered device by sending unspecified "data elements."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T11:00:00.000Z
CVE-2011-2742 
EMC RSA Adaptive Authentication On-Premise (AAOP) 6.0.2.1 SP1 Patch 2, SP1 Patch 3, SP2, SP2 Patch 1, and SP3 does not properly perform forensic evaluation upon receipt of device tokens from mobile apps, which might allow remote attackers to bypass intended application restrictions via a mobile device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T11:00:00.000Z
CVE-2011-2743 
Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php, or the (3) title or (4) body parameter to admin/help.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-19T21:00:00.000Z
CVE-2011-2744 
Directory traversal vulnerability in Chyrp 2.1 and earlier allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the action parameter to the default URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-19T20:00:00.000Z