rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-3502 
The proxy functionality in (1) mod_proxy_ajp.c in the mod_proxy_ajp module and (2) mod_proxy_http.c in the mod_proxy_http module in the Apache HTTP Server 2.4.x before 2.4.3 does not properly determine the situations that require closing a back-end connection, which allows remote attackers to obtain sensitive information in opportunistic circumstances by reading a response that was intended for a different client.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-22T19:00:00.000Z
CVE-2012-3503 
The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same secret token, and allows remote attackers to authenticate to the CloudForms System Engine web interface as an arbitrary user by creating a cookie using the default secret_token.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3504 
The nssconfigFound function in genkey.pl in crypto-utils 2.4.1-34 allows local users to overwrite arbitrary files via a symlink attack on the "list" file in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-10T18:00:00.000Z
CVE-2012-3505 
Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably.  bucket.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-3506 
Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-25T10:00:00.000Z
CVE-2012-3507 
Cross-site scripting (XSS) vulnerability in program/steps/mail/func.inc in RoundCube Webmail before 0.8.0, when using the Larry skin, allows remote attackers to inject arbitrary web script or HTML via the email message subject.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3508 
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3509 
Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of CHUNK_HEADER_SIZE to the length," which triggers a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3510 
Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3511 
Multiple race conditions in the madvise_remove function in mm/madvise.c in the Linux kernel before 3.4.5 allow local users to cause a denial of service (use-after-free and system crash) via vectors involving a (1) munmap or (2) close system call.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3512 
Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-3513 
munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-3514 
OCaml Xml-Light Library before r234 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T10:00:00.000Z
CVE-2012-3515 
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-3516 
The GNTTABOP_swap_grant_ref sub-operation in the grant table hypercall in Xen 4.2 and Citrix XenServer 6.0.2 allows local guest kernels or administrators to cause a denial of service (host crash) and possibly gain privileges via a crafted grant reference that triggers a write to an arbitrary hypervisor memory location.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-3517 
Use-after-free vulnerability in dns.c in Tor before 0.2.2.38 might allow remote attackers to cause a denial of service (daemon crash) via vectors related to failed DNS requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2012-3518 
The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2012-3519 
routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-26T01:00:00.000Z
CVE-2012-3520 
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3521 
Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2012-3522 
Cross-site scripting (XSS) vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-06-13T14:00:00.000Z
CVE-2012-3523 
The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-3524 
libdbus 1.5.x and earlier, when used in setuid or other privileged programs in X.org and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.  NOTE: libdbus maintainers state that this is a vulnerability in the applications that do not cleanse environment variables, not in libdbus itself: "we do not support use of libdbus in setuid binaries that do not sanitize their environment before their first call into libdbus."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-18T17:00:00.000Z
CVE-2012-3525 
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-25T16:00:00.000Z
CVE-2012-3526 
The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3527 
view_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to unserialize arbitrary objects and possibly execute arbitrary PHP code via an unspecified parameter, related to a "missing signature (HMAC)."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3528 
Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3529 
The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote authenticated backend users to obtain the encryption key via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3530 
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3531 
Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3532 
Cross-site request forgery (CSRF) vulnerability in the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-12T22:00:00.000Z
CVE-2012-3533 
The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T20:00:00.000Z
CVE-2012-3534 
GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of service (connection and thread consumption) via a large number of connections.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-31T20:00:00.000Z
CVE-2012-3535 
Heap-based buffer overflow in OpenJPEG 1.5.0 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted JPEG2000 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3536 
Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3.
Problem types: description: XSS
Affected products: vendor: Apache Software Foundation
product: Apache Hupa
Published: 2018-02-27T19:00:00.000Z
CVE-2012-3537 
The Crowbar Ohai plugin (chef/cookbooks/ohai/files/default/plugins/crowbar.rb) in the Deployer Barclamp in Crowbar, possibly 1.4 and earlier, allows local users to execute arbitrary shell commands via vectors related to "insecure handling of tmp files" and predictable file names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3538 
Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2012-3540 
Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3542 
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.  NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3543 
mono 2.10.x ASP.NET Web Form Hash collision DoS
Problem types: description: Hash collision issue
Affected products: vendor: mono
product: mono
Published: 2019-11-21T14:00:56.000Z
CVE-2012-3544 
Apache Tomcat 6.x before 6.0.37 and 7.x before 7.0.30 does not properly handle chunk extensions in chunked transfer coding, which allows remote attackers to cause a denial of service by streaming data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-06-01T10:00:00.000Z
CVE-2012-3546 
org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-19T11:00:00.000Z
CVE-2012-3547 
Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-18T17:00:00.000Z
CVE-2012-3548 
The dissect_drda function in epan/dissectors/packet-drda.c in Wireshark 1.6.x through 1.6.10 and 1.8.x through 1.8.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a small value for a certain length field in a capture file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-30T22:00:00.000Z
CVE-2012-3549 
The SCTP implementation in FreeBSD 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted ASCONF chunk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-09T23:00:00.000Z
CVE-2012-3551 
Cross-site scripting (XSS) vulnerability in crowbar_framework/app/views/support/index.html.haml in the Crowbar barclamp in Crowbar, possibly 1.4 and earlier, allows remote attackers to inject arbitrary web script or HTML via the file parameter to /utils.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-09-05T23:00:00.000Z
CVE-2012-3552 
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-03T10:00:00.000Z
CVE-2012-3553 
chan_skinny.c in the Skinny (aka SCCP) channel driver in Asterisk Open Source 10.x before 10.5.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by sending a Station Key Pad Button message and closing a connection in off-hook mode, a related issue to CVE-2012-2948.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-19T20:00:00.000Z
CVE-2012-3554 
SQL injection vulnerability in the RSGallery2 (com_rsgallery2) component before 2.3.0 for Joomla! 1.5.x, and before 3.2.0 for Joomla! 2.5.x, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-10T10:00:00.000Z
CVE-2012-3555 
Opera before 11.65 does not ensure that keyboard sequences are associated with a visible window, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary code via a crafted web site, related to a "hidden keyboard navigation" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3556 
Opera before 11.65 does not properly restrict the opening of a pop-up window in response to the first click of a double-click action, which makes it easier for user-assisted remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary code via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3557 
Opera before 11.65 does not properly restrict the reading of JSON strings, which allows remote attackers to perform cross-domain loading of JSON resources and consequently obtain sensitive information via a crafted web site.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3558 
Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it easier for user-assisted remote attackers to conduct spoofing attacks via vectors involving navigation, reloads, and redirects.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3559 
Unspecified vulnerability in Opera before 12.00 on Mac OS X has unknown impact and attack vectors, related to a "moderate severity issue."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3560 
Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during blocked navigation, which makes it easier for remote attackers to conduct spoofing attacks by detecting and preventing attempts to load a different web page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3561 
Opera before 11.64 does not properly allocate memory for URL strings, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3562 
Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application crash) via a crafted web page that is not properly handled during a reload, as demonstrated by a "multiple origin camera test" page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3563 
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via a web page that contains invalid character encodings.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3564 
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application hang) via an absolutely positioned wrap=off TEXTAREA element located next to an "overflow: auto" block element.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3565 
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted characters in domain names, as demonstrated by "IDNA2008 tests."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3566 
Opera before 12.00 Beta allows user-assisted remote attackers to cause a denial of service (application hang) via JavaScript code that changes a form before submission.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3567 
Opera before 12.00 Beta allows remote attackers to cause a denial of service (memory consumption or application hang) via an IFRAME element that uses the src="#" syntax to embed a parent document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3568 
Opera before 12.00 Beta allows remote attackers to cause a denial of service (application crash) via crafted WebGL content, as demonstrated by a codeflow.org WebGL demo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-14T19:00:00.000Z
CVE-2012-3569 
Format string vulnerability in VMware OVF Tool 2.1 on Windows, as used in VMware Workstation 8.x before 8.0.5, VMware Player 4.x before 4.0.5, and other products, allows user-assisted remote attackers to execute arbitrary code via a crafted OVF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-14T11:00:00.000Z
CVE-2012-3570 
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T10:00:00.000Z