rainbutterfly/cve_corpus huggingface dataset:
CVE-2013-0095 
Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the installation of a WebKit browser on the victim's machine, aka "Unintended Content Loading Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-13T00:00:00.000Z
CVE-2013-0096 
Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-15T01:00:00.000Z
CVE-2013-0107 
Stack-based buffer overflow in Foxit Advanced PDF Editor 3 before 3.04 might allow remote attackers to execute arbitrary code via a crafted document containing instructions that reconstruct a certain security cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-26T21:00:00.000Z
CVE-2013-0108 
An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T11:00:00.000Z
CVE-2013-0109 
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not properly handle exceptions, which allows local users to gain privileges or cause a denial of service (memory overwrite) via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-08T16:00:00.000Z
CVE-2013-0110 
nvSCPAPISvr.exe in the NVIDIA Stereoscopic 3D Driver service, as distributed with the NVIDIA driver before 307.78, and Release 310 before 311.00, on Windows, lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-08T16:00:00.000Z
CVE-2013-0111 
daemonu.exe (aka the NVIDIA Update Service Daemon), as distributed with the NVIDIA driver before 307.78, and Release 310 before 311.00, on Windows, lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-08T16:00:00.000Z
CVE-2013-0113 
Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T11:00:00.000Z
CVE-2013-0118 
CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T11:00:00.000Z
CVE-2013-0120 
The web interface on Dell PowerConnect 6248P switches allows remote attackers to cause a denial of service (device crash) via a malformed request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T11:00:00.000Z
CVE-2013-0122 
The avast! Mobile Security application before 2.0.4400 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.avast.android.mobilesecurity.app.scanner.DeleteFileActivity with zero arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-22T01:00:00.000Z
CVE-2013-0123 
Multiple SQL injection vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to execute arbitrary SQL commands via (1) the nHistoryId parameter to WebProd/pages/pgHistory.asp or (2) the OrderBy parameter to WebProd/pages/pgadmin.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-21T21:00:00.000Z
CVE-2013-0124 
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to inject arbitrary web script or HTML via the (1) Number or (2) UpdatePage parameter to WebProd/cgi-bin/AskiaExt.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-21T21:00:00.000Z
CVE-2013-0125 
Cross-site scripting (XSS) vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-04T19:00:00.000Z
CVE-2013-0126 
Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-21T20:00:00.000Z
CVE-2013-0127 
IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and JMOY95BN49.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-01T10:00:00.000Z
CVE-2013-0128 
The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an e-mail endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-04T19:00:00.000Z
CVE-2013-0129 
Multiple cross-site scripting (XSS) vulnerabilities in pd-admin before 4.17 allow remote authenticated users to inject arbitrary web script or HTML via (1) the WebFTP Overview "Create new directory" field or (2) the body of an e-mail autoresponder message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-19T10:00:00.000Z
CVE-2013-0130 
Multiple buffer overflows in Core FTP before 2.2 build 1769 allow remote FTP servers to execute arbitrary code or cause a denial of service (application crash) via a long directory name in a (1) DELE, (2) LIST, or (3) VIEW command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-29T15:00:00.000Z
CVE-2013-0131 
Buffer overflow in the NVIDIA GPU driver before 304.88, 310.x before 310.44, and 313.x before 313.30 for the X Window System on UNIX, when NoScanout mode is enabled, allows remote authenticated users to execute arbitrary code via a large ARGB cursor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-08T16:00:00.000Z
CVE-2013-0132 
The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-18T18:00:00.000Z
CVE-2013-0133 
Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-18T18:00:00.000Z
CVE-2013-0134 
Cross-site scripting (XSS) vulnerability in the web interface in AirDroid allows remote attackers to inject arbitrary web script or HTML via a crafted text message that is transmitted by a managed phone.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T01:00:00.000Z
CVE-2013-0135 
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-09T01:00:00.000Z
CVE-2013-0136 
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-01T10:00:00.000Z
CVE-2013-0137 
The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-29T21:00:00.000Z
CVE-2013-0138 
BitZipper 2013 before Update 1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ZIP archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-22T01:00:00.000Z
CVE-2013-0139 
The Arecont Vision AV1355DN MegaDome camera allows remote attackers to cause a denial of service (video-capture outage) via a packet to UDP port 69.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-18T18:00:00.000Z
CVE-2013-0140 
SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-01T10:00:00.000Z
CVE-2013-0141 
Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-01T10:00:00.000Z
CVE-2013-0142 
QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T20:00:00.000Z
CVE-2013-0143 
cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T20:00:00.000Z
CVE-2013-0144 
Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-07T20:00:00.000Z
CVE-2013-0145 
Buffer overflow in the TFTPD service in Serva32 2.1.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long string in a read request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-05-19T10:00:00.000Z
CVE-2013-0148 
The Data Camouflage (aka FairCom Standard Encryption) algorithm in FairCom c-treeACE does not ensure that a decryption key is needed for accessing database contents, which allows context-dependent attackers to read cleartext database records by copying a database to another system that has a certain default configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-16T17:00:00.000Z
CVE-2013-0149 
The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-03T01:00:00.000Z
CVE-2013-0150 
Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a ..  (dot dot) in the filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-09T18:00:00.000Z
CVE-2013-0151 
The do_hvm_op function in xen/arch/x86/hvm/hvm.c in Xen 4.2.x on the x86_32 platform does not prevent HVM_PARAM_NESTEDHVM (aka nested virtualization) operations, which allows guest OS users to cause a denial of service (long-duration page mappings and host OS crash) by leveraging administrative access to an HVM guest in a domain with a large number of VCPUs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-07T02:00:00.000Z
CVE-2013-0152 
Memory leak in Xen 4.2 and unstable allows local HVM guests to cause a denial of service (host memory consumption) by performing nested virtualization in a way that triggers errors that are not properly handled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2013-0153 
The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-14T22:00:00.000Z
CVE-2013-0154 
The get_page_type function in xen/arch/x86/mm.c in Xen 4.2, when debugging is enabled, allows local PV or HVM guest administrators to cause a denial of service (assertion failure and hypervisor crash) via unspecified vectors related to a hypercall.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-12T02:00:00.000Z
CVE-2013-0155 
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-13T22:00:00.000Z
CVE-2013-0156 
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-13T22:00:00.000Z
CVE-2013-0157 
(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T18:00:00.000Z
CVE-2013-0158 
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T22:00:00.000Z
CVE-2013-0159 
The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-05-01T19:00:00.000Z
CVE-2013-0160 
The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T02:00:00.000Z
CVE-2013-0161 
Havalite CMS 1.1.7 has a stored XSS vulnerability
Problem types: description: XSS
Affected products: vendor: Havalite
product: CMS
Published: 2020-01-29T14:54:30.000Z
CVE-2013-0162 
The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-01T02:00:00.000Z
CVE-2013-0163 
OpenShift haproxy cartridge: predictable /tmp in set-proxy connection hook which could facilitate DoS
Problem types: description: predictable /tmp in set-proxy connection hook
Affected products: vendor: OpenShift haproxy cartridge
product: OpenShift haproxy cartridge
Published: 2019-12-05T14:57:36.000Z
CVE-2013-0164 
The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T22:00:00.000Z
CVE-2013-0165 
cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp.
Problem types: description: Other
Affected products: vendor: OpenShift mongodb cartridge
product: OpenShift mongodb cartridge
Published: 2019-11-01T18:12:44.000Z
CVE-2013-0166 
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T19:00:00.000Z
CVE-2013-0167 
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with "unexpected fields."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-08-19T23:00:00.000Z
CVE-2013-0168 
The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T22:00:00.000Z
CVE-2013-0169 
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T19:00:00.000Z
CVE-2013-0170 
Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-08T20:00:00.000Z
CVE-2013-0171 
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-08T14:00:00.000Z
CVE-2013-0172 
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-17T21:00:00.000Z