rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-3799 
ReOS 2.0.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by padmin/blocks/vergal.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3800 
Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3801 
SimpleTest 1.0.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by test/visual_test.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3802 
StatusNet 0.9.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tpl/index.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3803 
SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layout_utils.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3804 
SweetRice 0.7.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by _plugin/tiny_mce/plugins/advimage/images.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3805 
TaskFreak! multi-mysql-0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by include/language/zh/register_info.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3806 
TCExam 11.1.015 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/code/tce_page_footer.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3807 
Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplib_db.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3808 
The Bug Genie 2.1.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/svn_integration/config.inc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3809 
TheHostingTool (THT) 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/pear/Mail/smtp.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3810 
TinyWebGallery (TWG) 1.8.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by i_frames/i_register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3811 
TomatoCart 1.1.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/system/offline.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3812 
Vanilla 2.0.16 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by plugins/Minify/min/utils.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3813 
Virtual War (aka VWar) 1.5.0r15 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/language/dutch.inc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3814 
WebCalendar 1.2.3, and other versions before 1.2.5, allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by ws/user_mod.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3815 
WeBid 1.0.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by js/calendar.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3816 
WEBinsta mailing list manager 1.3e allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by install/install3.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3817 
Website Baker 2.8.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by admin/media/parameters.php and certain other files.  NOTE: this might overlap CVE-2005-2436.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3818 
WordPress 2.9.2 and 3.0.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by wp-admin/includes/user.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3819 
WoW Server Status 4.1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by status.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3820 
WSN Software 6.0.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/prestart.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3821 
xajax 0.6 beta1 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by xajax_core/plugin_layer/xajaxScriptPlugin.inc.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3822 
XOOPS 2.5.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by modules/system/xoops_version.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3823 
Yamamah 1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/default/index.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3824 
Your Own URL Shortener (YOURLS) 1.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by includes/auth.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3825 
Zend Framework 1.11.3 in Zend Server CE 5.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by Validate.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3826 
Zikula 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/voodoodolly/version.php and certain other files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-24T00:00:00.000Z
CVE-2011-3827 
The iCalendar component in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted date-time string in a .ics attachment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-19T10:00:00.000Z
CVE-2011-3828 
DVRemoteAx.ax 2.1.0.39 in the DVR Remote ActiveX control allows remote attackers to execute arbitrary code via a crafted DVRobot.dll file in a manifest directory on a web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-26T02:00:00.000Z
CVE-2011-3829 
ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to obtain sensitive information via the file name, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-3830 
Cross-site scripting (XSS) vulnerability in search.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to inject arbitrary web script or HTML via the search_string parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-3831 
SQL injection vulnerability in incident_attachments.php in Support Incident Tracker (aka SiT!) 3.65 allows remote attackers to execute arbitrary SQL commands via an uploaded file with a crafted file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-3832 
Eval injection vulnerability in config.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated administrators to execute arbitrary PHP code via the application_name parameter in a save action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-3833 
Unrestricted file upload vulnerability in ftp_upload_file.php in Support Incident Tracker (aka SiT!) 3.65 allows remote authenticated users to execute arbitrary PHP code by uploading a PHP file, then accessing it via a direct request to the file in an unspecified directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-29T02:00:00.000Z
CVE-2011-3834 
Multiple integer overflows in the in_avi.dll plugin in Winamp before 5.623 allow remote attackers to execute arbitrary code via an AVI file with a crafted value for (1) the number of streams or (2) the size of the RIFF INFO chunk, leading to a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-16T19:00:00.000Z
CVE-2011-3835 
Multiple cross-site scripting (XSS) vulnerabilities in Wuzly 2.0 allow remote attackers to inject arbitrary web script or HTML via the Referer header to (1) admin/login.php and (2) admin/404.php; the (3) q parameter to search.php; the (4) theme_name parameter to theme_settings.php, (5) extension_name parameter to extension_settings.php, (6) q parameter to search.php, (7) type parameter to comments.php, sort parameter to (8) pages.php and (9) posts.php, and the (10) type and (11) q parameter to media.php in admin/; the sidebar parameter to (12) add_widget.php and (13) widgets.php, id parameter to (14) category_delete.php, (15) comment.php, (16) page_delete.php, and (17) post_delete.php, (18) type parameter to media.php, and (19) id and (20) sidebar parameter to widget_delete.php in mobile/; and the (21) name, (22) email, (23) website, and (24) comment parameters to index.php; and the (25) username parameter to admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-3836 
Multiple cross-site request forgery (CSRF) vulnerabilities in Wuzly 2.0 allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator, (2) perform cross-site scripting (XSS), (3) perform SQL injection, or have other unspecified impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-3837 
Directory traversal vulnerability in blog_system/data_functions.php in Wuzly 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the preview parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-3838 
Multiple SQL injection vulnerabilities in Wuzly 2.0 allow remote attackers to execute arbitrary SQL commands via the (1) u parameter to fp.php, (2) epage parameter to newpage.php, (3) epost parameter to newpost.php, and (4) username parameter to login.php in admin/; or the (5) username parameter to mobile/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-3839 
The administration functionality in Wuzly 2.0 allows remote attackers to bypass authentication by setting the dXNlcm5hbWU cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-3841 
Cross-site scripting (XSS) vulnerability in uploadify/get_profile_avatar.php in the WP Symposium plugin before 11.12.08 for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-27T11:00:00.000Z
CVE-2011-3844 
Apple Safari 5.0.5 does not properly implement the setInterval function, which allows remote attackers to spoof the address bar via a crafted web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-08T02:00:00.000Z
CVE-2011-3845 
Use-after-free vulnerability in Apple Safari 5.1.2, when a plug-in with a blocking function is installed, allows user-assisted remote attackers to execute arbitrary code via a crafted web page that is accessed during user interaction with the plug-in, leading to improper coordination between an API call and the plug-in unloading functionality, as demonstrated by the Adobe Flash and RealPlayer plug-ins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-03-08T02:00:00.000Z
CVE-2011-3846 
Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) 6.2.2.7 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-04-12T10:00:00.000Z
CVE-2011-3848 
Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-27T20:00:00.000Z
CVE-2011-3849 
Unspecified vulnerability in dxserver before 6279 in CA Directory 8.1 and CA Directory r12 before SP7 CR1 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-19T02:00:00.000Z
CVE-2011-3850 
Cross-site scripting (XSS) vulnerability in the Atahualpa theme before 3.6.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3851 
Cross-site scripting (XSS) vulnerability in the News theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3852 
Cross-site scripting (XSS) vulnerability in the EvoLve theme before 1.2.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3853 
Cross-site scripting (XSS) vulnerability in the Hybrid theme before 0.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3854 
Cross-site scripting (XSS) vulnerability in the ZenLite theme before 4.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3855 
Cross-site scripting (XSS) vulnerability in the F8 Lite theme before 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3856 
Cross-site scripting (XSS) vulnerability in the Elegant Grunge theme before 1.0.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3857 
Cross-site scripting (XSS) vulnerability in the Antisnews theme before 1.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3858 
Cross-site scripting (XSS) vulnerability in the Pixiv Custom theme before 2.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3859 
Cross-site scripting (XSS) vulnerability in the Trending theme before 0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3860 
Cross-site scripting (XSS) vulnerability in the Cover WP theme before 1.6.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3861 
Cross-site scripting (XSS) vulnerability in the Web Minimalist 200901 theme before 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3862 
Cross-site scripting (XSS) vulnerability in the Morning Coffee theme before 3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3863 
Cross-site scripting (XSS) vulnerability in the RedLine theme before 1.66 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3864 
Cross-site scripting (XSS) vulnerability in the The Erudite theme before 2.7.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cpage parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3865 
Cross-site scripting (XSS) vulnerability in the Black-LetterHead theme before 1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-28T10:00:00.000Z
CVE-2011-3866 
Mozilla Firefox before 7.0 and SeaMonkey before 2.4 do not properly restrict availability of motion data events, which makes it easier for remote attackers to read keystrokes by leveraging JavaScript code running in a background tab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-29T00:00:00.000Z
CVE-2011-3868 
Buffer overflow in VMware Workstation 7.x before 7.1.5, VMware Player 3.x before 3.1.5, VMware Fusion 3.1.x before 3.1.3, and VMware AMS allows remote attackers to execute arbitrary code via a crafted UDF filesystem in an ISO image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-07T20:00:00.000Z
CVE-2011-3869 
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-27T20:00:00.000Z
CVE-2011-3870 
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-27T20:00:00.000Z
CVE-2011-3871 
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-27T20:00:00.000Z