rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-1038 
Multiple cross-site scripting (XSS) vulnerabilities in stconf.nsf in the server in IBM Lotus Sametime 8.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the messageString parameter in a WebMessage action or (2) the PATH_INFO.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T18:00:00.000Z
CVE-2011-1042 
Use-after-free vulnerability in flimflamd in flimflam in Google Chrome OS before 0.9.130.14 Beta allows user-assisted remote attackers to cause a denial of service (daemon crash) by providing the name of a hidden WiFi network that does not respond to connection attempts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T16:00:00.000Z
CVE-2011-1044 
The ib_uverbs_poll_cq function in drivers/infiniband/core/uverbs_cmd.c in the Linux kernel before 2.6.37 does not initialize a certain response buffer, which allows local users to obtain potentially sensitive information from kernel memory via vectors that cause this buffer to be only partially filled, a different vulnerability than CVE-2010-4649.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T19:00:00.000Z
CVE-2011-1045 
Unspecified vulnerability in the Rendition Engine (aka P8RE) 4.0.1 through 4.5.1 in IBM FileNet P8 Content Manager (CM) allows remote attackers to gain privileges via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T17:00:00.000Z
CVE-2011-1046 
IBM FileNet P8 Content Engine (aka P8CE) 4.0.1 through 5.0.0, as used in FileNet P8 Content Manager (CM) and FileNet P8 Business Process Manager (BPM), does not require the PRIVILEGED_WRITE access role for all intended Object Store modifications, which allows remote attackers to change a privileged property of an object via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T17:00:00.000Z
CVE-2011-1047 
Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1048 
SQL injection vulnerability in product.php in MihanTools 1.33 allows remote attackers to execute arbitrary SQL commands via the id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1049 
Buffer overflow in the Mach-O input file loader in Hex-Rays IDA Pro 5.7 and 6.0 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Macho-O file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1050 
Unspecified vulnerability in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to "converson of string encodings" and "inconsistencies in the handling of UTF8 sequences by the user interface."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1051 
Integer overflow in the COFF/EPOC/EXPLOAD input file loaders in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1052 
Integer overflow in the PSX/GEOS input file loaders in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1053 
Unspecified vulnerability in the Mach-O input file loader in Hex-Rays IDA Pro 5.7 and 6.0 allows user-assisted remote attackers to cause a denial of service (out-of-memory exception and inability to analyze code) via a crafted Mach-O file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1054 
Unspecified vulnerability in the PEF input file loader in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1055 
SQL injection vulnerability in api/ice_media.cfc in Lingxia I.C.E CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the session.user_id parameter to media.cfm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T18:00:00.000Z
CVE-2011-1056 
The installer for Metasploit Framework 3.5.1, when running on Windows, uses weak inherited permissions for the Metasploit installation directory, which allows local users to gain privileges by replacing critical files with a Trojan horse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T20:00:00.000Z
CVE-2011-1058 
Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T17:00:00.000Z
CVE-2011-1059 
Use-after-free vulnerability in WebCore in WebKit before r77705, as used in Google Chrome before 11.0.672.2 and other products, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that entice a user to resubmit a form, related to improper handling of provisional items by the HistoryController component, aka rdar problem 8938557.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T18:00:00.000Z
CVE-2011-1060 
SQL injection vulnerability in the member function in classes/member.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands via the wsnuser cookie to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T23:00:00.000Z
CVE-2011-1061 
SQL injection vulnerability in memberlist.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands via the time parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T23:00:00.000Z
CVE-2011-1062 
Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sContext, (2) sort, (3) dir, and (4) show parameters in a save action to index.php; the (5) dir and (6) show parameters to print_list.php; and the (7) HTTP referer header to rss.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T23:00:00.000Z
CVE-2011-1063 
Multiple cross-site scripting (XSS) vulnerabilities in Cherry-Design Photopad 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data[title] parameters in an edit action to files.php, or (3) id parameter in a view action to gallery.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T23:00:00.000Z
CVE-2011-1064 
SQL injection vulnerability in member/list.php in qibosoft Qi Bo CMS 7 allows remote attackers to execute arbitrary SQL commands via the aidDB[] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T23:00:00.000Z
CVE-2011-1065 
Multiple stack-based buffer overflows in the PIPIWebPlayer ActiveX control (PIWebPlayer.ocx) in PIPI Player 2.8.0.0 allow remote attackers to execute arbitrary code via long arguments to the (1) PlayURL or (2) PlayURLWithLocalPlayer methods.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T23:00:00.000Z
CVE-2011-1066 
Cross-site scripting (XSS) vulnerability in the Messaging module 6.x-2.x before 6.x-2.4 and 6.x-4.x before 6.x-4.0-beta8 for Drupal allows remote attackers with administer messaging permissions to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-22T23:00:00.000Z
CVE-2011-1067 
slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not properly manage the c_timelimit field of the connection table element, which allows remote attackers to cause a denial of service (daemon outage) via Simple Paged Results connections, as demonstrated by using multiple processes to replay TCP sessions, a different vulnerability than CVE-2011-0019.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-23T18:00:00.000Z
CVE-2011-1068 
Microsoft Windows Azure Software Development Kit (SDK) 1.3.x before 1.3.20121.1237, when Full IIS and a Web Role are used with an ASP.NET application, does not properly support the use of cookies for maintaining state, which allows remote attackers to obtain potentially sensitive information by reading an encrypted cookie and performing unspecified other steps.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-23T18:00:00.000Z
CVE-2011-1069 
PHPShop through 0.8.1 has XSS.
Problem types: description: Cross-Site Scripting
Affected products: vendor: PHPShop
product: PHPShop
Published: 2020-02-05T20:45:17.000Z
CVE-2011-1070 
v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and potentially other consequences.
Problem types: description: Other
Affected products: vendor: v86d
product: v86d
Published: 2019-11-14T00:37:09.000Z
CVE-2011-1071 
The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-08T15:00:00.000Z
CVE-2011-1072 
The installer in PEAR before 1.9.2 allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories, a different vulnerability than CVE-2007-2519.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-03T00:00:00.000Z
CVE-2011-1073 
crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to (1) determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and (2) perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks on /tmp/crontab.XXXXXXXXXX temporary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-04T22:00:00.000Z
CVE-2011-1074 
crontab.c in crontab in FreeBSD allows local users to determine the existence of arbitrary directories via a command-line argument composed of a directory name concatenated with a directory traversal sequence that leads to the /etc/crontab pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-04T22:00:00.000Z
CVE-2011-1075 
FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.
Problem types: cwe_id: CWE-362
description: CWE-362
Affected products: vendor: n/a
product: FreeBSD/crontab
Published: 2021-10-19T14:08:58.000Z
CVE-2011-1076 
net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query, as demonstrated by an erroneous grand.centrall.org query, which triggers improper handling of error data within a DNS resolver key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-05T01:00:00.000Z
CVE-2011-1077 
Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-06-02T20:00:00.000Z
CVE-2011-1078 
The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2011-1079 
The bnep_sock_ioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service (BUG and system crash), via a BNEPCONNADD command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2011-1080 
The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2011-1081 
modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-20T01:00:00.000Z
CVE-2011-1082 
fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-03T01:00:00.000Z
CVE-2011-1083 
The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-03T01:00:00.000Z
CVE-2011-1084 
A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Smoothwall
product: Smoothwall Express
Published: 2020-02-07T20:50:50.000Z
CVE-2011-1085 
CSRF vulnerability in Smoothwall Express 3.
Problem types: description: Cross-Site Request Forgery
Affected products: vendor: Smoothwall
product: Smoothwall Express
Published: 2020-02-07T20:51:58.000Z
CVE-2011-1086 
Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter.
Problem types: description: Cross-Site Scripting
Affected products: vendor: Openfiler
product: Openfiler
Published: 2020-02-07T21:06:27.000Z
CVE-2011-1087 
Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .mp3 file that is played during bookmark creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-03T19:00:00.000Z
CVE-2011-1088 
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-14T19:00:00.000Z
CVE-2011-1089 
The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-10T01:29:00.000Z
CVE-2011-1090 
The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-09T19:00:00.000Z
CVE-2011-1091 
libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-14T19:00:00.000Z
CVE-2011-1092 
Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-15T17:00:00.000Z
CVE-2011-1093 
The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-07-18T22:00:00.000Z
CVE-2011-1094 
kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-16T22:00:00.000Z
CVE-2011-1095 
locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-10T01:29:00.000Z
CVE-2011-1096 
The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses, aka "character encoding pattern attack."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2011-1097 
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-30T22:00:00.000Z
CVE-2011-1098 
Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-30T22:00:00.000Z
CVE-2011-1099 
Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the p parameter in a preview action to index.php, or (2) delete arbitrary files via a .. (dot dot) in the p parameter in a delete action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-09T22:00:00.000Z
CVE-2011-1100 
Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) findfid, (2) id, (3) selectfcat, (4) selectfmon, or (5) selectftag parameter in an images action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-25T16:00:00.000Z
CVE-2011-1101 
Multiple unspecified vulnerabilities in a third-party component of the Citrix Licensing Administration Console 11.6, formerly License Management Console, allow remote attackers to (1) access unauthorized "license administration functionality" or (2) cause a denial of service via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-25T18:00:00.000Z
CVE-2011-1102 
Cross-site scripting (XSS) vulnerability in the WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and hotfix 2 on Linux, and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-25T18:00:00.000Z
CVE-2011-1103 
The WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and hotfix 2 on Linux, and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux, allows remote attackers to obtain sensitive information via a request to an invalid report, which reveals the installation path in an error message, as demonstrated with requests to (1) report/infection-table.html or (2) report/productsummary-table.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-25T18:00:00.000Z