rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-3884 
Cross-site request forgery (CSRF) vulnerability in CMS Made Simple 1.8.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that reset the administrative password. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-08T20:00:00.000Z
CVE-2010-3886 
The CTimeoutEventList::InsertIntoTimeoutList function in Microsoft mshtml.dll uses a certain pointer value as part of producing Timer ID values for the setTimeout and setInterval methods in VBScript and JScript, which allows remote attackers to obtain sensitive information about the heap memory addresses used by an application, as demonstrated by the Internet Explorer 8 application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-08T21:00:00.000Z
CVE-2010-3887 
The Limit Mail feature in the Parental Controls functionality in Mail on Apple Mac OS X does not properly enforce the correspondence whitelist, which allows remote attackers to bypass intended access restrictions and conduct e-mail communication by leveraging knowledge of a child's e-mail address and a parent's e-mail address, related to parental notification of unapproved e-mail addresses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-08T21:00:00.000Z
CVE-2010-3888 
Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited in the wild in July 2010 by the Stuxnet worm, and identified by Kaspersky Lab researchers and other researchers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-08T21:00:00.000Z
CVE-2010-3889 
Unspecified vulnerability in Microsoft Windows on 32-bit platforms allows local users to gain privileges via unknown vectors, as exploited in the wild in July 2010 by the Stuxnet worm, and identified by Microsoft researchers and other researchers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-08T21:00:00.000Z
CVE-2010-3890 
Cross-site scripting (XSS) vulnerability in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to inject arbitrary web script or HTML via the command parameter to the administration interface, as demonstrated by the command parameter to ESAdmin/collection.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T20:00:00.000Z
CVE-2010-3891 
Cross-site request forgery (CSRF) vulnerability in ESAdmin/security.do in the administrator interface in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a saveNewUser action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T20:00:00.000Z
CVE-2010-3892 
Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID (aka SID) value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3893 
The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID (aka SID) value to a single IP address, which allows remote attackers to perform arbitrary administrative actions by leveraging cookie theft, related to a "session impersonation" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3894 
Stack-based buffer overflow in the Java_com_ibm_es_oss_CryptionNative_ESEncrypt function in /opt/IBM/es/lib/libffq.cryptionjni.so in the login form in the administration interface in IBM OmniFind Enterprise Edition before 8.5 FP6 allows remote attackers to execute arbitrary code via a long password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3895 
esRunCommand in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges by specifying an arbitrary command name as the first argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3896 
The ESSearchApplication directory tree in IBM OmniFind Enterprise Edition 8.x and 9.x does not require authentication, which allows remote attackers to modify the server configuration via a request to palette.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3897 
ESSearchApplication/palette.do in IBM OmniFind Enterprise Edition 8.x and 9.x includes the administrator password in the HTML source code, which might allow remote attackers to obtain sensitive information by leveraging read access to this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3898 
IBM OmniFind Enterprise Edition 8.x and 9.x does not properly restrict the cookie path of administrator (aka ESAdmin) cookies, which might allow remote attackers to bypass authentication by leveraging access to other pages on the web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3899 
IBM OmniFind Enterprise Edition 8.x and 9.x performs web crawls with an unlimited recursion depth, which allows remote web servers to cause a denial of service (infinite loop) via a crafted series of documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-12T21:00:00.000Z
CVE-2010-3900 
Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-12T21:00:00.000Z
CVE-2010-3901 
OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-12T21:00:00.000Z
CVE-2010-3902 
OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-12T21:00:00.000Z
CVE-2010-3903 
Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service (application crash) via a 404 HTTP status code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-12T21:00:00.000Z
CVE-2010-3904 
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-06T20:00:00.000Z
CVE-2010-3905 
The password reset feature in the administrator interface for Eucalyptus 2.0.0 and 2.0.1 does not perform authentication, which allows remote attackers to gain privileges by sending password reset requests for other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-22T20:00:00.000Z
CVE-2010-3906 
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-17T18:00:00.000Z
CVE-2010-3907 
Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a zero i_subpackets value in a Real Media file, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-03T19:26:00.000Z
CVE-2010-3908 
FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed WMV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-05-20T22:00:00.000Z
CVE-2010-3909 
Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct request to the file in the storage/ directory tree.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-26T19:00:00.000Z
CVE-2010-3910 
Multiple directory traversal vulnerabilities in the return_application_language function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang_crm parameter to phprint.php or (2) the current_language parameter in an Accounts Import action to graph.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-26T19:00:00.000Z
CVE-2010-3911 
Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via (1) the username (aka default_user_name) field or (2) the password field in a Users Login action to index.php, or (3) the label parameter in a Settings GetFieldInfo action to index.php, related to modules/Settings/GetFieldInfo.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-26T19:00:00.000Z
CVE-2010-3912 
The supportconfig script in supportutils in SUSE Linux Enterprise 11 SP1 and 10 SP3 does not "disguise passwords" in configuration files, which has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-12T23:00:00.000Z
CVE-2010-3913 
CRLF injection vulnerability in TransWARE Active! mail 6 build 6.40.010047750 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T16:28:00.000Z
CVE-2010-3914 
Untrusted search path vulnerability in VIM Development Group GVim before 7.3.034, and possibly other versions before 7.3.46, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse User32.dll or other DLL that is located in the same folder as a .TXT file.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-03T01:00:00.000Z
CVE-2010-3915 
Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted document, a different vulnerability than CVE-2010-3916.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-3916 
Unspecified vulnerability in JustSystems Ichitaro and Ichitaro Government allows remote attackers to execute arbitrary code via a crafted document, a different vulnerability than CVE-2010-3915.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-05T22:00:00.000Z
CVE-2010-3917 
Google Chrome before 3.0 does not properly handle XML documents, which allows remote attackers to obtain sensitive information via a crafted web site.
Problem types: description: Other
Affected products: vendor: Google
product: Chrome
Published: 2020-02-06T12:52:24.000Z
CVE-2010-3918 
Fenrir Sleipnir 2.9.6 and earlier does not prevent interaction between web script and the clipboard, which allows remote attackers to read or modify the clipboard contents via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-10T18:00:00.000Z
CVE-2010-3919 
Fenrir Grani 4.5 and earlier does not prevent interaction between web script and the clipboard, which allows remote attackers to read or modify the clipboard contents via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-10T18:00:00.000Z
CVE-2010-3920 
The Seiko Epson printer driver installers for LP-S9000 before 4.1.11 and LP-S7100 before 4.1.7, or as downloaded from the vendor between May 2010 and 20101125, set weak permissions for the "C:\Program Files" folder, which might allow local users to bypass intended access restrictions and create or modify arbitrary files and directories.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-08T19:00:00.000Z
CVE-2010-3921 
Cross-site scripting (XSS) vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-09T19:00:00.000Z
CVE-2010-3922 
SQL injection vulnerability in Movable Type 4.x before 4.35 and 5.x before 5.04 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-09T19:00:00.000Z
CVE-2010-3923 
Untrusted search path vulnerability in AttacheCase before 2.70 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-30T20:00:00.000Z
CVE-2010-3924 
SQL injection vulnerability in Aimluck Aipo before 5.1.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-13T18:35:00.000Z
CVE-2010-3925 
Contents-Mall before 15 does not properly handle passwords, which allows remote attackers to discover the administrative password, and consequently obtain sensitive information or modify data, via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-13T18:35:00.000Z
CVE-2010-3926 
Multiple cross-site scripting (XSS) vulnerabilities in Shop.cgi in SGX-SP Final before 11.00 and SGX-SP Final NE before 11.00 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-12T00:00:00.000Z
CVE-2010-3927 
Untrusted search path vulnerability in Lunascape before 6.4.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-24T17:00:00.000Z
CVE-2010-3928 
Ruby Version Manager (RVM) before 1.2.1 writes file contents to a terminal without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via a crafted file, related to an "escape sequence injection vulnerability." NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2010-3929 
SQL injection vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via unknown vectors related to AjaxSearch.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2010-3930 
Directory traversal vulnerability in MODx Evolution 1.0.4 and earlier allows remote attackers to read arbitrary files via unspecified vectors related to AjaxSearch, a different vulnerability than CVE-2010-1427.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-02T00:00:00.000Z
CVE-2010-3931 
Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and earlier, pplog2 3.37 and earlier, PM bbs 1.07 and earlier, PM up bbs 1.08 and earlier, and PM forum 1.18 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2010-3933 
Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-27T22:00:00.000Z
CVE-2010-3934 
The browser in Research In Motion (RIM) BlackBerry Device Software 5.0.0.593 Platform 5.1.0.147 on the BlackBerry 9700 does not properly restrict cross-domain execution of JavaScript, which allows remote attackers to bypass the Same Origin Policy via vectors related to a window.open call and an IFRAME element.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-10-14T18:00:00.000Z
CVE-2010-3936 
Cross-site scripting (XSS) vulnerability in Signurl.asp in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold, 2010 Update 1, and 2010 Update 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "XSS in Signurl.asp Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-11-10T01:00:00.000Z
CVE-2010-3937 
Microsoft Exchange Server 2007 SP2 on the x64 platform allows remote authenticated users to cause a denial of service (infinite loop and MSExchangeIS outage) via a crafted RPC request, aka "Exchange Server Infinite Loop Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3939 
Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via vectors related to improper memory allocation for copies from user mode, aka "Win32k Buffer Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3940 
Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 allows local users to gain privileges via a crafted application, aka "Win32k PFE Pointer Double Free Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3941 
Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold and SP2, and Windows 7 allows local users to gain privileges via a crafted application, aka "Win32k Double Free Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3942 
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly allocate memory for copies from user mode, which allows local users to gain privileges via a crafted application, aka "Win32k WriteAV Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3943 
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly link driver objects, which allows local users to gain privileges via a crafted application that triggers linked-list corruption, aka "Win32k Cursor Linking Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3944 
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 and Windows 7 does not properly validate user-mode input, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3945 
Buffer overflow in the CGM image converter in the graphics filters in Microsoft Office XP SP3, Office 2003 SP3, and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted CGM image in an Office document, aka "CGM Image Converter Buffer Overrun Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3946 
Integer overflow in the PICT image converter in the graphics filters in Microsoft Office XP SP3, Office 2003 SP3, and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted PICT image in an Office document, aka "PICT Image Converter Integer Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3947 
Heap-based buffer overflow in the TIFF image converter in the graphics filters in Microsoft Office XP SP3, Office Converter Pack, and Works 9 allows remote attackers to execute arbitrary code via a crafted TIFF image in an Office document, aka "TIFF Image Converter Heap Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3949 
Buffer overflow in the TIFF image converter in the graphics filters in Microsoft Office XP SP3 and Office Converter Pack allows remote attackers to execute arbitrary code via a crafted TIFF image in an Office document, aka "TIFF Image Converter Buffer Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z
CVE-2010-3950 
The TIFF image converter in the graphics filters in Microsoft Office XP SP3, Office Converter Pack, and Works 9 does not properly convert data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TIFF image in an Office document, aka "TIFF Image Converter Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2010-12-16T19:00:00.000Z