rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-3365 
The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-29T17:00:00.000Z
CVE-2011-3366 
Rekonq 0.7.0 and earlier does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-29T17:00:00.000Z
CVE-2011-3367 
Arora, possibly 0.11 and other versions, does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers to spoof the common name (CN) of a certificate via rich text.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-29T17:00:00.000Z
CVE-2011-3368 
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-05T22:00:00.000Z
CVE-2011-3369 
The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet, related to the get_rpc function in decode_proto.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-30T17:00:00.000Z
CVE-2011-3370 
statusnet before 0.9.9 has XSS
Problem types: description: unspecified
Affected products: vendor: statusnet
product: statusnet
Published: 2019-11-12T13:59:18.000Z
CVE-2011-3371 
Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7) form_sent, (8) csrf_token, (9) req_message, or (10) submit parameter to edit.php, the (11) action, (12) form_sent, (13) csrf_token, (14) req_email, or (15) request_pass parameter to login.php, the (16) email, (17) form_sent, (18) redirect_url, (19) csrf_token, (20) req_subject, (21) req_message, or (22) submit parameter to misc.php, the (23) action, (24) id, (25) form_sent, (26) csrf_token, (27) req_old_password, (28) req_new_password1, (29) req_new_password2, or (30) update parameter to profile.php, or the (31) action, (32) form_sent, (33) csrf_token, (34) req_username, (35) req_password1, (36) req_password2, (37) req_email1, (38) timezone, or (39) register parameter to register.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-02T20:00:00.000Z
CVE-2011-3372 
imap/nntpd.c in the NNTP server (nntpd) for Cyrus IMAPd 2.4.x before 2.4.12 allows remote attackers to bypass authentication by sending an AUTHINFO USER command without sending an additional AUTHINFO PASS command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-3373 
Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack.
Problem types: description: Cross-Site Scripting
Affected products: vendor: drupal6-views_bulk_operations
product: drupal6-views_bulk_operations
Published: 2019-11-25T22:43:40.000Z
CVE-2011-3374 
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.
Problem types: description: Other
Affected products: vendor: apt
product: apt
Published: 2019-11-25T23:13:02.000Z
CVE-2011-3375 
Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-01-19T02:00:00.000Z
CVE-2011-3376 
org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local users to gain privileges by using an untrusted web application to access the Manager application's functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-11T21:00:00.000Z
CVE-2011-3377 
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-05T19:00:00.000Z
CVE-2011-3378 
RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-24T19:00:00.000Z
CVE-2011-3379 
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-03T15:00:00.000Z
CVE-2011-3380 
Openswan 2.6.29 through 2.6.35 allows remote attackers to cause a denial of service (NULL pointer dereference and pluto IKE daemon crash) via an ISAKMP message with an invalid KEY_LENGTH attribute, which is not properly handled by the error handling function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-17T19:00:00.000Z
CVE-2011-3381 
Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-08T18:00:00.000Z
CVE-2011-3382 
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-08T18:00:00.000Z
CVE-2011-3383 
Cross-site scripting (XSS) vulnerability in KENT-WEB WEB FORUM 5.1 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors related to "the web page to be output."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-24T17:00:00.000Z
CVE-2011-3384 
Cross-site scripting (XSS) vulnerability in the Sage add-on 1.3.10 and earlier for Firefox allows remote attackers to inject arbitrary web script or HTML via a crafted feed, a different vulnerability than CVE-2009-4102.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-08T18:00:00.000Z
CVE-2011-3385 
Cross-site scripting (XSS) vulnerability in WebsiteBaker before 2.8, as used in LEPTON and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unknown vectors, a different vulnerability than CVE-2006-2307.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-02T17:00:00.000Z
CVE-2011-3386 
Unspecified vulnerability in Medtronic Paradigm wireless insulin pump 512, 522, 712, and 722 allows remote attackers to modify the delivery of an insulin bolus dose and cause a denial of service (adverse human health effects) via unspecified vectors involving wireless communications and knowledge of the device's serial number, as demonstrated by Jerome Radcliffe at the Black Hat USA conference in August 2011.  NOTE: the vendor has disputed the severity of this issue, saying "we believe the risk of deliberate, malicious, or unauthorized manipulation of medical devices is extremely low... we strongly believe it would be extremely difficult for a third-party to wirelessly tamper with your insulin pump... you would be able to detect tones on the insulin pump that weren't intentionally programmed and could intervene accordingly."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-02T23:00:00.000Z
CVE-2011-3387 
The class file parser in IBM Java 1.4.2 SR13 FP9 allows remote authenticated users to cause a denial of service (memory consumption or an infinite loop) via a crafted attribute length field in a class file, related to validation of a length field at the wrong time, a different vulnerability than CVE-2011-0311.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-02T23:00:00.000Z
CVE-2011-3388 
Opera before 11.51 allows remote attackers to cause an insecure site to appear secure or trusted via unspecified actions related to Extended Validation and loading content from trusted sources in an unspecified sequence that causes the address field and page information dialog to contain security information based on the trusted site, instead of the insecure site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T19:00:00.000Z
CVE-2011-3389 
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T19:00:00.000Z
CVE-2011-3390 
Multiple cross-site scripting (XSS) vulnerabilities in index.php in IBM OpenAdmin Tool (OAT) before 2.72 for Informix allow remote attackers to inject arbitrary web script or HTML via the (1) informixserver, (2) host, or (3) port parameter in a login action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-06T15:00:00.000Z
CVE-2011-3391 
IBM Rational Build Forge 7.1.2 relies on client-side JavaScript code to enforce the EditSecurity permission requirement for the Export Key File function, which allows remote authenticated users to read a key file by removing a disable attribute in the Security sub-menu.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-08T18:00:00.000Z
CVE-2011-3392 
Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-08T18:00:00.000Z
CVE-2011-3393 
Multiple cross-site scripting (XSS) vulnerabilities in findagent.php in MYRE Real Estate Software allow remote attackers to inject arbitrary web script or HTML via the (1) country1, (2) state1, or (3) city1 parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-15T15:00:00.000Z
CVE-2011-3394 
SQL injection vulnerability in findagent.php in MYRE Real Estate Software allows remote attackers to execute arbitrary SQL commands via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-15T15:00:00.000Z
CVE-2011-3396 
Untrusted search path vulnerability in Microsoft PowerPoint 2007 SP2 and 2010 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "PowerPoint Insecure Library Loading Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3397 
The Microsoft Time component in DATIME.DLL in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted web site that leverages an unspecified "binary behavior" in Internet Explorer, aka "Microsoft Time Remote Code Execution Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3400 
Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka "OLE Property Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3401 
ENCDEC.DLL in Windows Media Player and Media Center in Microsoft Windows XP SP2 and SP3, Windows Vista SP2, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted .dvr-ms file, aka "Windows Media Player DVR-MS Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3402 
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-11-04T21:00:00.000Z
CVE-2011-3403 
Microsoft Excel 2003 SP3 and Office 2004 for Mac do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet, aka "Record Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3404 
Microsoft Internet Explorer 6 through 9 does not properly use the Content-Disposition HTTP header to control rendering of the HTTP response body, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Content-Disposition Information Disclosure Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3406 
Buffer overflow in Active Directory, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote authenticated users to execute arbitrary code via a crafted query that leverages incorrect memory initialization, aka "Active Directory Buffer Overflow Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3408 
Csrsrv.dll in the Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly check permissions for sending inter-process device-event messages from low-integrity processes to high-integrity processes, which allows local users to gain privileges via a crafted application, aka "CSRSS Local Privilege Elevation Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3410 
Array index error in Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka "Publisher Out-of-bounds Array Index Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3411 
Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect handling of values in memory, aka "Publisher Invalid Pointer Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3412 
Microsoft Publisher 2003 SP3, and 2007 SP2 and SP3, allows remote attackers to execute arbitrary code via a crafted Publisher file that leverages incorrect memory handling, aka "Publisher Memory Corruption Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3413 
Microsoft PowerPoint 2007 SP2; Office 2008 for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and PowerPoint Viewer 2007 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an invalid OfficeArt record in a PowerPoint document, aka "OfficeArt Shape RCE Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-14T00:00:00.000Z
CVE-2011-3414 
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-3415 
Open redirect vulnerability in the Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted return URL, aka "Insecure Redirect in .NET Form Authentication Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-3416 
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 allows remote authenticated users to obtain access to arbitrary user accounts via a crafted username, aka "ASP.Net Forms Authentication Bypass Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-3417 
The Forms Authentication feature in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0, when sliding expiry is enabled, does not properly handle cached content, which allows remote attackers to obtain access to arbitrary user accounts via a crafted URL, aka "ASP.NET Forms Authentication Ticket Caching Vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-12-30T01:00:00.000Z
CVE-2011-3420 
Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.157 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-10T00:00:00.000Z
CVE-2011-3421 
Multiple unspecified vulnerabilities in Google Chrome before 14.0.835.125 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-10T00:00:00.000Z
CVE-2011-3422 
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-10T00:00:00.000Z
CVE-2011-3423 
Cross-site scripting (XSS) vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-17T10:00:00.000Z
CVE-2011-3424 
Session fixation vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1, and the server in TIBCO Slingshot before 1.8.1, allows remote attackers to hijack web sessions via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-09-17T10:00:00.000Z
CVE-2011-3426 
Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3427 
The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3428 
Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T19:00:00.000Z
CVE-2011-3429 
The Settings component in Apple iOS before 5 stores a cleartext parental-restrictions passcode in an unspecified file, which might allow physically proximate attackers to obtain sensitive information by reading this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z
CVE-2011-3430 
The Settings component in Apple iOS before 5, when a configuration profile is used for a locale other than English, does not properly implement localization, which makes it easier for attackers to have an unspecified impact by leveraging incorrect configuration display.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-14T10:00:00.000Z