rainbutterfly/cve_corpus huggingface dataset:
CVE-2011-0445 
The ASN.1 BER dissector in Wireshark 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (assertion failure) via crafted packets, as demonstrated by fuzz-2010-12-30-28473.pcap.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-12T23:00:00.000Z
CVE-2011-0446 
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-14T20:00:00.000Z
CVE-2011-0447 
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-14T20:00:00.000Z
CVE-2011-0448 
Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T00:00:00.000Z
CVE-2011-0449 
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-21T17:00:00.000Z
CVE-2011-0450 
The downloads manager in Opera before 11.01 on Windows does not properly determine the pathname of the filesystem-viewing application, which allows user-assisted remote attackers to execute arbitrary code via a crafted web site that hosts an executable file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-31T19:00:00.000Z
CVE-2011-0451 
Multiple cross-site scripting (XSS) vulnerabilities in (1) data/Smarty/templates/default/list.tpl and (2) data/Smarty/templates/default/campaign/bloc/cart_tag.tpl in EC-CUBE before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-03T15:00:00.000Z
CVE-2011-0452 
Untrusted search path vulnerability in the script function in Lunascape before 6.4.3 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-24T20:00:00.000Z
CVE-2011-0453 
F-Secure Internet Gatekeeper for Linux 3.x before 3.03 does not require authentication for reading access logs, which allows remote attackers to obtain potentially sensitive information via a TCP session on the admin UI port.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T16:00:00.000Z
CVE-2011-0454 
Buffer overflow in the PPP Access Concentrator (PPPAC) on the SEIL/x86 with firmware 1.00 through 1.61, SEIL/B1 with firmware 1.00 through 3.11, SEIL/X1 with firmware 1.00 through 3.11, SEIL/X2 with firmware 1.00 through 3.11, SEIL/Turbo with firmware 1.80 through 2.10, and SEIL/neu 2FE Plus with firmware 1.80 through 2.10 might allow remote attackers to execute arbitrary code via a PPPoE packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-01T22:00:00.000Z
CVE-2011-0455 
Cross-site scripting (XSS) vulnerability in Things BBS before 2.0.3 and BBS Thread before 2.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-03T00:00:00.000Z
CVE-2011-0456 
webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-11T17:00:00.000Z
CVE-2011-0457 
Cross-site scripting (XSS) vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-15T17:00:00.000Z
CVE-2011-0458 
Untrusted search path vulnerability in the Locate on Disk feature in Google Picasa before 3.8 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-28T16:00:00.000Z
CVE-2011-0459 
Cross-site scripting (XSS) vulnerability in Cyber-Ark Password Vault Web Access (PVWA) 5.0 and earlier, 5.5 through 5.5 patch 4, and 6.0 through 6.0 patch 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-10-05T01:00:00.000Z
CVE-2011-0460 
The init script in kbd, possibly 1.14.1 and earlier, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/defkeymap.map.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-16T18:00:00.000Z
CVE-2011-0461 
/etc/init.d/boot.localfs in the aaa_base package before 11.2-43.48.1 in SUSE openSUSE 11.2, and before 11.3-8.7.1 in openSUSE 11.3, allows local users to overwrite arbitrary files via a symlink attack on /dev/shm/mtab.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-01T21:00:00.000Z
CVE-2011-0462 
Multiple cross-site scripting (XSS) vulnerabilities in the login page in the webui component in SUSE openSUSE Build Service (OBS) before 2.1.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-10T01:00:00.000Z
CVE-2011-0463 
The ocfs2_prepare_page_for_write function in fs/ocfs2/aops.c in the Oracle Cluster File System 2 (OCFS2) subsystem in the Linux kernel before 2.6.39-rc1 does not properly handle holes that cross page boundaries, which allows local users to obtain potentially sensitive information from uninitialized disk locations by reading a file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-10T01:00:00.000Z
CVE-2011-0464 
Unspecified vulnerability in Novell Vibe OnPrem 3.0 before Hot Patch 1 allows remote attackers to execute arbitrary code via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-09T22:00:00.000Z
CVE-2011-0465 
xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-08T15:00:00.000Z
CVE-2011-0466 
The API in SUSE openSUSE Build Service (OBS) 2.0.x before 2.0.8 and 2.1.x before 2.1.6 allows attackers to bypass intended write-access restrictions and modify a (1) package or (2) project via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-10T01:00:00.000Z
CVE-2011-0467 SQL injection in SUSE studio via select parameter
A vulnerability in the listing of available software of SUSE Studio Onsite, SUSE Studio Onsite 1.1 Appliance allows authenticated users to execute arbitrary SQL statements via SQL injection. Affected releases are SUSE Studio Onsite: versions prior to 1.0.3-0.18.1, SUSE Studio Onsite 1.1 Appliance: versions prior to 1.1.2-0.25.1.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: SUSE
product: SUSE Studio Onsite
vendor: SUSE
product: SUSE Studio Onsite 1.1 Appliance
Credits: lang: en
value: Matthias Weckbecker of SUSE
Published: 2018-06-07T21:00:00.000Z
CVE-2011-0468 
The aaa_base package before 11.3-8.9.1 in SUSE openSUSE 11.3, and before 11.4-54.62.1 in openSUSE 11.4, allows local users to gain privileges via shell metacharacters in a filename, related to tab expansion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-01T21:00:00.000Z
CVE-2011-0469 
Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.
Problem types: description: remote code execution
Affected products: vendor: Micro Focus
product: openSUSE
Published: 2017-08-17T16:00:00.000Z
CVE-2011-0470 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle extensions notification, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0471 
The node-iteration implementation in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 does not properly handle pointers, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0472 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle the printing of PDF documents, which allows user-assisted remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a multi-page document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0473 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with CANVAS elements, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0474 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle Cascading Style Sheets (CSS) token sequences in conjunction with cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0475 
Use-after-free vulnerability in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0476 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 allow remote attackers to cause a denial of service (stack memory corruption) or possibly have unspecified other impact via a PDF document that triggers an out-of-memory error.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0477 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle a mismatch in video frame sizes, which allows remote attackers to cause a denial of service (incorrect memory access) or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0478 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle SVG use elements, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0479 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly interact with extensions, which allows remote attackers to cause a denial of service via a crafted extension that triggers an uninitialized pointer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0480 
Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0481 
Buffer overflow in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to PDF shading.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0482 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of anchors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted HTML document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0483 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform a cast of an unspecified variable during handling of video, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0484 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly perform DOM node removal, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale rendering node."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0485 
Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344 do not properly handle speech data, which allows remote attackers to execute arbitrary code via unspecified vectors that lead to a "stale pointer."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-14T16:00:00.000Z
CVE-2011-0486 
Cross-site scripting (XSS) vulnerability in cognos.cgi in IBM Cognos 8 Business Intelligence (BI) 8.4.1 before FP1 allows remote attackers to inject arbitrary web script or HTML via the pathinfo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-18T17:00:00.000Z
CVE-2011-0487 
ICQ 7 does not verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a crafted file that is fetched through an automatic-update mechanism.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-18T17:00:00.000Z
CVE-2011-0488 
Stack-based buffer overflow in NTWebServer.exe in the test web service in InduSoft NTWebServer, as distributed in Advantech Studio 6.1 and InduSoft Web Studio 7.0, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long request to TCP port 80.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-18T17:00:00.000Z
CVE-2011-0489 
The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the Advanced Multithreaded Server, as demonstrated by commands that are ordinarily sent by the (a) ookillls and (b) oostopams applications.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-18T17:00:00.000Z
CVE-2011-0490 
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha makes calls to Libevent within Libevent log handlers, which might allow remote attackers to cause a denial of service (daemon crash) via vectors that trigger certain log messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T11:00:00.000Z
CVE-2011-0491 
The tor_realloc function in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not validate a certain size value during memory allocation, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors, related to "underflow errors."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T11:00:00.000Z
CVE-2011-0492 
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (assertion failure and daemon exit) via blobs that trigger a certain file size, as demonstrated by the cached-descriptors.new file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T11:00:00.000Z
CVE-2011-0493 
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha might allow remote attackers to cause a denial of service (assertion failure and daemon exit) via vectors related to malformed router caches and improper handling of integer values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T11:00:00.000Z
CVE-2011-0494 
Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 5.1 before 5.1.0.39-TIV-AWS-IF0040, 6.0 before 6.0.0.25-TIV-AWS-IF0026, 6.1.0 before 6.1.0.5-TIV-AWS-IF0006, and 6.1.1 before 6.1.1-TIV-AWS-FP0001 has unspecified impact and attack vectors.  NOTE: this might overlap CVE-2010-4622.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T11:00:00.000Z
CVE-2011-0495 
Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0496 
Unspecified vulnerability in Sybase EAServer 5.x and 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to install arbitrary web services and execute arbitrary code, related to a "design vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0497 
Directory traversal vulnerability in Sybase EAServer 6.x before 6.3 ESD#2, as used in Appeon, Replication Server Messaging Edition (RSME), and WorkSpace, allows remote attackers to read arbitrary files via "../\" (dot dot forward-slash backslash) sequences in a crafted request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0498 
Stack-based buffer overflow in Nokia Multimedia Player 1.00.55.5010, and possibly other versions, allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long entry in a playlist (.npl) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0499 
Buffer overflow in VideoSpirit Pro 1.6.8.1 and possibly earlier versions, and VideoSpirit Lite 1.4.0.1 and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long "name" attribute.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0500 
Buffer overflow in VideoSpirit Pro 1.6.8.1, 1.68, and earlier; and VideoSpirit Lite 1.4.0.1 and possibly other versions; allows user-assisted remote attackers to execute arbitrary code via a VideoSpirit project (.visprj) file containing a valitem element with a long "value" attribute, as demonstrated using a valitem with the mp3 name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0501 
Stack-based buffer overflow in Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to execute arbitrary code via a long line in a .mamx file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0502 
Music Animation Machine MIDI Player 2006aug19 Release 035 and possibly other versions allows user-assisted remote attackers to cause a denial of service (crash) and possibly have other unspecified impact via a long line in a MIDI (.mid) file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0503 
Cross-site request forgery (CSRF) vulnerability in VaM Shop 1.6, 1.6.1, and probably earlier versions allows remote attackers to hijack the authentication of administrators for requests that (1) change user status via admin/customers.php or (2) change user permissions via admin/accounting.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0504 
Multiple cross-site scripting (XSS) vulnerabilities in VaM Shop 1.6, 1.6.1, and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the (1) status parameter to admin/orders.php, (2) search parameter to admin/customers.php, or (3) STORE_NAME parameter to admin/configuration.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0505 
Directory traversal vulnerability in system/system.php in Zwii 2.1.1, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the set[template][value] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0506 
Directory traversal vulnerability in modules/profile/user.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to execute arbitrary code via a .. (dot dot) in the aXconf[default_language] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z