rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-3384 
Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T17:00:00.000Z
CVE-2012-3385 
WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-22T17:00:00.000Z
CVE-2012-3386 
The "make distcheck" rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory, which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T21:00:00.000Z
CVE-2012-3387 
Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias (aka shortcut) restrictions via a client that omits this check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3388 
The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3389 
Multiple cross-site scripting (XSS) vulnerabilities in mod/lti/typessettings.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) lti_typename or (2) lti_toolurl parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3390 
lib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict file access after a block has been hidden, which allows remote authenticated users to obtain sensitive information by reading a file that is embedded in a block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3391 
mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a forum.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3392 
mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3393 
Cross-site scripting (XSS) vulnerability in repository/lib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 allows remote authenticated administrators to inject arbitrary web script or HTML by renaming a repository.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3394 
auth/ldap/ntlmsso_attempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3395 
SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute arbitrary SQL commands via crafted form data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3396 
Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2365.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3397 
lib/modinfolib.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 does not check for a group-membership requirement when determining whether an activity is unavailable or hidden, which allows remote authenticated users to bypass intended access restrictions by selecting an activity that is configured for a group of other users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3398 
Algorithmic complexity vulnerability in Moodle 1.9.x before 1.9.19, 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to cause a denial of service (CPU consumption) by using the advanced-search feature on a database activity that has many records.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-23T21:00:00.000Z
CVE-2012-3399 
Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T19:00:00.000Z
CVE-2012-3400 
Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3401 
The t2p_read_tiff_init function in tiff2pdf (tools/tiff2pdf.c) in LibTIFF 4.0.2 and earlier does not properly initialize the T2P context struct pointer in certain error conditions, which allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TIFF image that triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T20:00:00.000Z
CVE-2012-3402 
Integer overflow in plug-ins/common/psd.c in the Adobe Photoshop PSD plugin in GIMP 2.2.13 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted channels header value in a PSD image file, which triggers a heap-based buffer overflow, a different vulnerability than CVE-2009-3909.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3403 
Heap-based buffer overflow in the KiSS CEL file format plug-in in GIMP 2.8.x and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted KiSS palette file, which triggers an "invalid free."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3404 
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T17:00:00.000Z
CVE-2012-3405 
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T17:00:00.000Z
CVE-2012-3406 
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-10T17:00:00.000Z
CVE-2012-3407 
plow has local buffer overflow vulnerability
Problem types: description: UNKNOWN_TYPE
Affected products: vendor: plow
product: plow
Published: 2019-11-22T14:32:57.000Z
CVE-2012-3408 
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-06T16:00:00.000Z
CVE-2012-3409 
ecryptfs-utils: suid helper does not restrict mounting filesystems with nosuid,nodev which creates a possible privilege escalation
Problem types: description: suid helper does not restrict mounting filesystems with nosuid,nodev leading to possible privilege escalation
Affected products: vendor: ecryptfs-utils
product: ecryptfs-utils
Published: 2019-12-20T13:33:05.000Z
CVE-2012-3410 
Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-3411 
Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-04T21:00:00.000Z
CVE-2012-3412 
The sfc (aka Solarflare Solarstorm) driver in the Linux kernel before 3.2.30 allows remote attackers to cause a denial of service (DMA descriptor consumption and network-controller outage) via crafted TCP packets that trigger a small MSS value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3413 
The HTMLQuoteColorer::process function in messageviewer/htmlquotecolorer.cpp in KDE PIM 4.6 through 4.8 does not disable JavaScript, Java, and Plugins, which allows remote attackers to inject arbitrary web script or HTML via a crafted email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T20:00:00.000Z
CVE-2012-3414 
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-07-19T10:00:00.000Z
CVE-2012-3416 
Condor before 7.8.2 allows remote attackers to bypass host-based authentication and execute actions such as ALLOW_ADMINISTRATOR or ALLOW_WRITE by connecting from a system with a spoofed reverse DNS hostname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3417 
The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T20:00:00.000Z
CVE-2012-3418 
libpcp in Performance Co-Pilot (PCP) before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a PDU with the numcreds field value greater than the number of actual elements to the __pmDecodeCreds function in p_creds.c; (2) the string byte number value to the __pmDecodeNameList function in p_pmns.c; (3) the numids value to the __pmDecodeIDList function in p_pmns.c; (4) unspecified vectors to the __pmDecodeProfile function in p_profile.c; the (5) status number value or (6) string number value to the __pmDecodeNameList function in p_pmns.c; (7) certain input to the __pmDecodeResult function in p_result.c; (8) the name length field (namelen) to the DecodeNameReq function in p_pmns.c; (9) a crafted PDU_FETCH request to the __pmDecodeFetch function in p_fetch.c; (10) the namelen field in the __pmDecodeInstanceReq function in p_instance.c; (11) the buflen field to the __pmDecodeText function in p_text.c; (12) PDU_INSTANCE packets to the __pmDecodeInstance in p_instance.c; or the (13) c_numpmid or (14) v_numval fields to the __pmDecodeLogControl function in p_lcontrol.c, which triggers integer overflows, heap-based buffer overflows, and/or buffer over-reads.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-3419 
Performance Co-Pilot (PCP) before 3.6.5 exports some of the /proc file system, which allows attackers to obtain sensitive information such as proc/pid/maps and command line arguments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-3420 
Multiple memory leaks in Performance Co-Pilot (PCP) before 3.6.5 allow remote attackers to cause a denial of service (memory consumption or daemon crash) via a large number of PDUs with (1) a crafted context number to the DoFetch function in pmcd/src/dofetch.c or (2) a negative type value to the __pmGetPDU function in libpcp/src/pdu.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-3421 
The pduread function in pdu.c in libpcp in Performance Co-Pilot (PCP) before 3.6.5 does not properly time out connections, which allows remote attackers to cause a denial of service (pmcd hang) by sending individual bytes of a PDU separately, related to an "event-driven programming flaw."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-27T23:00:00.000Z
CVE-2012-3422 
The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page, which causes an uninitialized memory location to be read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T21:00:00.000Z
CVE-2012-3423 
The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T21:00:00.000Z
CVE-2012-3424 
The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-08T10:00:00.000Z
CVE-2012-3425 
The png_push_read_zTXt function in pngpread.c in libpng 1.0.x before 1.0.58, 1.2.x before 1.2.48, 1.4.x before 1.4.10, and 1.5.x before 1.5.10 allows remote attackers to cause a denial of service (out-of-bounds read) via a large avail_in field value in a PNG image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T20:00:00.000Z
CVE-2012-3426 
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-31T10:00:00.000Z
CVE-2012-3427 
EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services (AWS) credentials by reading files in the directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-02-02T20:00:00.000Z
CVE-2012-3428 
The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-20T11:00:00.000Z
CVE-2012-3429 
The dns_to_ldap_dn_escape function in src/ldap_convert.c in bind-dyndb-ldap 1.1.0rc1 and earlier does not properly escape distinguished names (DN) for LDAP queries, which allows remote DNS servers to cause a denial of service (named service hang) via a "$" character in a DN in a DNS query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T21:00:00.000Z
CVE-2012-3430 
The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3431 
The Teiid Java Database Connectivity (JDBC) socket, as used in JBoss Enterprise Data Services Platform before 5.3.0, does not encrypt login messages by default contrary to documentation and specification, which allows remote attackers to obtain login credentials via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-3432 
The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-3433 
Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service (domain 0 VCPU hang and kernel panic) by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-3434 
Multiple cross-site scripting (XSS) vulnerabilities in userperspan.php in the Count Per Day module before 3.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page, (2) datemin, or (3) datemax parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-15T21:00:00.000Z
CVE-2012-3435 
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-15T20:00:00.000Z
CVE-2012-3436 
OpenTTD 0.6.0 through 1.2.1 does not properly validate requests to clear a water tile, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a certain sequence of steps related to "the water/coast aspect of tiles which also have railtracks on one half."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T18:00:00.000Z
CVE-2012-3437 
The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T21:00:00.000Z
CVE-2012-3438 
The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-07T21:00:00.000Z
CVE-2012-3440 
A certain Red Hat script for sudo 1.7.2 on Red Hat Enterprise Linux (RHEL) 5 allows local users to overwrite arbitrary files via a symlink attack on the /var/tmp/nsswitch.conf.bak temporary file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-08T10:00:00.000Z
CVE-2012-3441 
The database creation script (module/idoutils/db/scripts/create_mysqldb.sh) in Icinga 1.7.1 grants access to all databases to the icinga user, which allows icinga users to access other databases via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3442 
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-31T17:00:00.000Z