rainbutterfly/cve_corpus huggingface dataset:
CVE-2010-5295 
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T01:00:00.000Z
CVE-2010-5296 
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T01:00:00.000Z
CVE-2010-5297 
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-21T01:00:00.000Z
CVE-2010-5298 
Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-04-14T16:00:00.000Z
CVE-2010-5299 
Stack-based buffer overflow in MicroP 0.1.1.1600 allows remote attackers to execute arbitrary code via a crafted .mppl file.  NOTE: it has been reported that the overflow is in the lpFileName parameter of the CreateFileA function, but the overflow is probably caused by a separate, unnamed function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-05-23T00:00:00.000Z
CVE-2010-5300 
Stack-based buffer overflow in Jzip 1.3 through 2.0.0.132900 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name in a zip archive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-11T14:00:00.000Z
CVE-2010-5301 
Stack-based buffer overflow in Kolibri 2.0 allows remote attackers to execute arbitrary code via a long URI in a HEAD request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2010-5302 
Cross-site scripting (XSS) vulnerability in timthumb.php in TimThumb before 1.15 as of 20100908 (r88), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T23:00:00.000Z
CVE-2010-5303 
Cross-site scripting (XSS) vulnerability in the displayError function in timthumb.php in TimThumb before 1.15 (r85), as used in multiple products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to $errorString.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-21T23:00:00.000Z
CVE-2010-5304 
A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-05T19:35:35.000Z
CVE-2010-5305 Rockwell PLC5/SLC5/0x/RSLogix Credentials management
The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controllers. The potential exists for an unauthorized programming and configuration client to gain access to the product and allow changes to the product’s configuration or program. When applicable, upgrade product firmware to a version that includes enhanced security functionality compatible with Rockwell Automation's FactoryTalk Security services.
Problem types: cwe_id: CWE-255
description: Credentials management CWE-255
Affected products: vendor: Rockwell Automation
product: PLC5
default_status: unaffected
vendor: Rockwell Automation
product: SLC5/0x
default_status: unaffected
vendor: Rockwell Automation
product: RSLogix
default_status: unaffected
Published: 2019-03-26T17:24:25.000Z
CVE-2010-5306 
GE Healthcare Optima CT680, CT540, CT640, and CT520 has a default password of #bigguy for the root user, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2010-5307 
The HIPAA configuration interface in GE Healthcare Optima MR360 has a password of (1) operator for the root account, (2) adw2.0 for the admin account, and (3) adw2.0 for the sdc account, which has unspecified impact and attack vectors.  NOTE: it is not clear whether these passwords are default, hardcoded, or dependent on another system or product that requires a fixed value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2010-5308 
GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen.  NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2010-5309 
GE Healthcare CADStream Server has a default password of confirma for the admin user, which has unspecified impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2010-5310 
The Acquisition Workstation for the GE Healthcare Revolution XQ/i has a password of adw3.1 for the sdc user, which has unspecified impact and attack vectors.  NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-08-04T10:00:00.000Z
CVE-2010-5312 
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-24T00:00:00.000Z
CVE-2010-5313 
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-11-30T01:00:00.000Z
CVE-2010-5314 
Cross-site scripting (XSS) vulnerability in controllers/home_controller.php in BEdita before 3.1 allows remote attackers to inject arbitrary web script or HTML via the searchstring parameter to news/index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-03T11:00:00.000Z
CVE-2010-5315 
Multiple cross-site request forgery (CSRF) vulnerabilities in BEdita before 3.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create categories via a data array to news/saveCategories or (2) modify credentials via a data array to admin/saveUser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-03T11:00:00.000Z
CVE-2010-5316 
Cross-site scripting (XSS) vulnerability in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to inject arbitrary web script or HTML via a top_height cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-03T11:00:00.000Z
CVE-2010-5317 
Multiple SQL injection vulnerabilities in index.php in SweetRice CMS before 0.6.7.1 allow remote attackers to execute arbitrary SQL commands via (1) the file_name parameter in an attachment action, (2) the post parameter in a show_comment action, (3) the sys-name parameter in an rssfeed action, or (4) the sys-name parameter in a view action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-03T11:00:00.000Z
CVE-2010-5318 
The password-reset feature in as/index.php in SweetRice CMS before 0.6.7.1 allows remote attackers to modify the administrator's password by specifying the administrator's e-mail address in the email parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-03T11:00:00.000Z
CVE-2010-5319 
Multiple cross-site request forgery (CSRF) vulnerabilities in Kandidat CMS 1.4.2 allow remote attackers to hijack the authentication of administrators for requests that (1) modify settings via a validate action to admin/settings.php, (2) modify pages via the what parameter to admin/edit.php, or (3) modify articles via the edit parameter to admin/news.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-03T11:00:00.000Z
CVE-2010-5320 
Multiple cross-site request forgery (CSRF) vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the authentication of administrators for requests that (1) modify settings via a configuration action to admin.php, (2) modify articles via an articles action to admin.php, or (3) modify credentials via a users action to admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-01-03T11:00:00.000Z
CVE-2010-5321 
Memory leak in drivers/media/video/videobuf-core.c in the videobuf subsystem in the Linux kernel 2.6.x through 4.x allows local users to cause a denial of service (memory consumption) by leveraging /dev/video access for a series of mmap calls that require new allocations, a different vulnerability than CVE-2007-6761.  NOTE: as of 2016-06-18, this affects only 11 drivers that have not been updated to use videobuf2 instead of videobuf.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T06:12:00.000Z
CVE-2010-5322 
Cross-site scripting (XSS) vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-03-11T14:00:00.000Z
CVE-2010-5323 
Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a crafted WAR pathname in the filename parameter in conjunction with WAR content in the POST data, a different vulnerability than CVE-2010-5324.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-07T23:00:00.000Z
CVE-2010-5324 
Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter, in conjunction with a WAR filename in the filename parameter and WAR content in the POST data, a different vulnerability than CVE-2010-5323.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2015-06-07T23:00:00.000Z
CVE-2010-5325 
Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a long job title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-04-15T14:00:00.000Z
CVE-2010-5326 
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a "Detour" attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2016-05-13T10:00:00.000Z
CVE-2010-5327 
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-01-13T19:00:00.000Z
CVE-2010-5328 
include/linux/init_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapper process, which allows local users to cause a denial of service (system crash) by leveraging access to this process group.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-02-06T06:04:00.000Z
CVE-2010-5329 
The video_usercopy function in drivers/media/video/v4l2-ioctl.c in the Linux kernel before 2.6.39 relies on the count value of a v4l2_ext_controls data structure to determine a kmalloc size, which might allow local users to cause a denial of service (memory consumption) via a large value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-04-24T06:12:00.000Z
CVE-2010-5330 
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-06-11T20:46:05.000Z
CVE-2010-5331 
In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least one Linux maintainer believes that this CVE is incorrectly assigned and should be rejected because the value is hard coded and are not user-controllable where it is used
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T21:38:21.000Z
CVE-2010-5332 
In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-07-27T21:38:33.000Z
CVE-2010-5333 
The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-09-13T15:40:58.000Z
CVE-2010-5334 
IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (_c to basic/index.html) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:36:18.000Z
CVE-2010-5335 
IceWarp Webclient before 10.2.1 has a directory traversal vulnerability. This can result in loss of confidential data of IceWarp Mailserver and the operating system. Input passed via a certain parameter (script to basic/minimizer/index.php) is not properly sanitised and can therefore be exploited to browse the partition where IceWarp is installed (or the whole system) and read arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:36:09.000Z
CVE-2010-5336 
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:35:59.000Z
CVE-2010-5337 
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][controller] is non-persistent in 10.1.3 and 10.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:35:50.000Z
CVE-2010-5338 
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action] is non-persistent in 10.1.3 and 10.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:35:42.000Z
CVE-2010-5339 
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] is non-persistent in 10.1.3 and 10.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:35:33.000Z
CVE-2010-5340 
IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-11T10:35:20.000Z
CVE-2011-0001 
Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-03-15T17:00:00.000Z
CVE-2011-0002 
libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-22T21:00:00.000Z
CVE-2011-0003 
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-11T01:00:00.000Z
CVE-2011-0004 
Multiple cross-site scripting (XSS) vulnerabilities in Piwik before 1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-10T19:18:00.000Z
CVE-2011-0005 
Cross-site scripting (XSS) vulnerability in the com_search module for Joomla! 1.0.x through 1.0.15 allows remote attackers to inject arbitrary web script or HTML via the ordering parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-11T01:00:00.000Z
CVE-2011-0006 
The ima_lsm_rule_init function in security/integrity/ima/ima_policy.c in the Linux kernel before 2.6.37, when the Linux Security Modules (LSM) framework is disabled, allows local users to bypass Integrity Measurement Architecture (IMA) rules in opportunistic circumstances by leveraging an administrator's addition of an IMA rule for LSM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T23:00:00.000Z
CVE-2011-0007 
pimd 2.1.5 and possibly earlier versions allows user-assisted local users to overwrite arbitrary files via a symlink attack on (1) pimd.dump when a USR1 signal is sent, or (2) pimd.cache when USR2 is sent.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-11T01:00:00.000Z
CVE-2011-0008 
A certain Fedora patch for parse.c in sudo before 1.7.4p5-1.fc14 on Fedora 14 does not properly interpret a system group (aka %group) in the sudoers file during authorization decisions for a user who belongs to that group, which allows local users to leverage an applicable sudoers file and gain root privileges via a sudo command.  NOTE: this vulnerability exists because of a CVE-2009-0034 regression.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-20T18:00:00.000Z
CVE-2011-0009 
Best Practical Solutions RT 3.x before 3.8.9rc2 and 4.x before 4.0.0rc4 uses the MD5 algorithm for password hashes, which makes it easier for context-dependent attackers to determine cleartext passwords via a brute-force attack on the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-25T18:00:00.000Z
CVE-2011-0010 
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-18T17:00:00.000Z
CVE-2011-0011 
qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-21T15:00:00.000Z
CVE-2011-0012 
The SPICE Firefox plug-in (spice-xpi) 2.4, 2.3, 2.2, and possibly other versions allows local users to overwrite arbitrary files via a symlink attack on the usbrdrctl log file, which has a predictable name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-04-18T17:00:00.000Z
CVE-2011-0013 
Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T23:00:00.000Z
CVE-2011-0014 
ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-02-18T23:00:00.000Z
CVE-2011-0015 
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly check the amount of compression in zlib-compressed data, which allows remote attackers to cause a denial of service via a large compression factor.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T11:00:00.000Z
CVE-2011-0016 
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly manage key data in memory, which might allow local users to obtain sensitive information by leveraging the ability to read memory that was previously used by a different process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2011-01-19T11:00:00.000Z