rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-4489 
Open redirect vulnerability in the securelogin_secure_redirect function in the Secure Login module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4490 
Multiple cross-site scripting (XSS) vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a (1) user name or (2) email address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4491 
The Monthly Archive by Node Type module 6.x for Drupal does not properly check permissions defined by node_access modules, which allows remote attackers to access restricted nodes via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4492 
Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report or (2) Custom Services List page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4493 
Cross-site scripting (XSS) vulnerability in the administrative interface in the Better Revisions module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-02T15:00:00.000Z
CVE-2012-4494 
The Shibboleth authentication module 7.x-4.0 for Drupal does not properly check the active status of users, which allows remote blocked users to access bypass intended access restrictions and possibly have other impacts by logging in.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4495 
The Mime Mail module 6.x-1.x before 6.x-1.1 for Drupal does not properly restrict access to files outside Drupal's publish files directory, which allows remote authenticated users to send arbitrary files as attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4496 
Cross-site scripting (XSS) vulnerability in the Custom Publishing Options module 6.x-1.x before 6.x-1.4 for Drupal allows remote authenticated users with the "administer nodes" permission to inject arbitrary web script or HTML via the status labels parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4497 
Cross-site scripting (XSS) vulnerability in the "3 slide gallery" in the Elegant Theme module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-02T15:00:00.000Z
CVE-2012-4498 
The Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the "Campaign" content type, which might allow remote attackers to bypass access restrictions and possibly have other unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-02T15:00:00.000Z
CVE-2012-4499 
The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4500 
The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4501 
Citrix Cloud.com CloudStack, and Apache CloudStack pre-release, allows remote attackers to make arbitrary API calls by leveraging the system user account, as demonstrated by API calls to delete VMs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-26T10:00:00.000Z
CVE-2012-4502 
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5) RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which triggers an out-of-bounds read or buffer overflow.  NOTE: versions 1.27 and 1.28 do not require authentication to exploit.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T21:00:00.000Z
CVE-2012-4503 
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-11-05T21:00:00.000Z
CVE-2012-4504 
Stack-based buffer overflow in the url::get_pac function in url.cpp in libproxy 0.4.x before 0.4.9 allows remote servers to have an unspecified impact via a large proxy.pac file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4505 
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4506 
Directory traversal vulnerability in gitolite 3.x before 3.1, when wild card repositories and a pattern matching "../" are enabled, allows remote authenticated users to create arbitrary repositories and possibly perform other actions via a .. (dot dot) in a repository name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4507 
The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted email.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4508 
Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-21T11:00:00.000Z
CVE-2012-4510 
cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows user-assisted remote attackers to read or overwrite sensitive files using CUPS resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-20T00:00:00.000Z
CVE-2012-4511 
services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle (MITM) attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4512 
The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face source, related to "type confusion."
Problem types: description: Other
Affected products: vendor: KDE
product: Konqueror
Published: 2020-02-08T18:09:56.000Z
CVE-2012-4513 
khtml/imload/scaledimageplane.h in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via large canvas dimensions, which leads to an unexpected sign extension and a heap-based buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4514 
rendering/render_replaced.cpp in Konqueror in KDE before 4.9.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted web page, related to "trying to reuse a frame with a null part."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4515 
Use-after-free vulnerability in khtml/rendering/render_replaced.cpp in Konqueror in KDE 4.7.3, when the context menu is shown, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by accessing an iframe when it is being updated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4516 
librdmacm 1.0.16, when ibacm.port is not specified, connects to port 6125, which allows remote attackers to specify the address resolution information for the application via a malicious ib_acm service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4517 
ibacm before 1.0.6 does not properly manage reference counts for multicast connections, which allows remote attackers to cause a denial of service (ibacm service crash) via a crafted join response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4518 
ibacm 1.0.7 creates files with world-writable permissions, which allows local users to overwrite the ib_acm daemon log or ibacm.port file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-22T23:00:00.000Z
CVE-2012-4519 
Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS.
Problem types: description: XSS
Affected products: vendor: Zenphoto
product: Zenphoto
Published: 2020-02-11T17:19:42.000Z
CVE-2012-4520 
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-18T23:00:00.000Z
CVE-2012-4522 
The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-4523 
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-20T00:00:00.000Z
CVE-2012-4524 
xlockmore before 5.43 'dclock' security bypass vulnerability
Problem types: description: bypass
Affected products: vendor: xlockmore
product: xlockmore
Published: 2019-11-21T14:11:41.000Z
CVE-2012-4525 
piwigo has XSS in password.php
Problem types: description: in password.php
Affected products: vendor: piwigo
product: piwigo
Published: 2019-12-02T17:46:59.000Z
CVE-2012-4526 
piwigo has XSS in password.php (incomplete fix for CVE-2012-4525)
Problem types: description: in password.php, incomplete fix for CVE-2012-4525
Affected products: vendor: piwigo
product: piwigo
Published: 2019-12-02T17:48:45.000Z
CVE-2012-4527 
Stack-based buffer overflow in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name.  NOTE: it is not clear whether this is a vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-4528 
The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-28T11:00:00.000Z
CVE-2012-4529 
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id (1) via a man-in-the-middle attack or (2) by reading a log.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-10-28T21:00:00.000Z
CVE-2012-4530 
The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-18T02:00:00.000Z
CVE-2012-4531 
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4532 
Cross-site scripting (XSS) vulnerability in modules/mod_languages/tmpl/default.php in the Language Switcher module for Joomla! 2.5.x before 2.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4533 
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-19T00:00:00.000Z
CVE-2012-4534 
org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-19T11:00:00.000Z
CVE-2012-4535 
Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an "inappropriate deadline."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-4536 
The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service (Xen crash) via a crafted pirq value that triggers an out-of-bounds read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-4537 
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-4538 
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-4539 
Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service (infinite loop and hang or crash) via invalid arguments to GNTTABOP_get_status_frames, aka "Grant table hypercall infinite loop DoS vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-21T23:00:00.000Z
CVE-2012-4540 
Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4541 
Cross-site scripting (XSS) vulnerability in Piwik before 1.9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-19T11:00:00.000Z
CVE-2012-4542 
block/scsi_ioctl.c in the Linux kernel through 3.8 does not properly consider the SCSI device class during authorization of SCSI commands, which allows local users to bypass intended access restrictions via an SG_IO ioctl call that leverages overlapping opcodes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-28T19:00:00.000Z
CVE-2012-4543 
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2012-4544 
The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T16:00:00.000Z
CVE-2012-4545 
The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-03T01:00:00.000Z
CVE-2012-4546 
The default configuration for IPA servers in Red Hat Enterprise Linux 6, when revoking a certificate from an Identity Management replica, does not properly update another Identity Management replica, which causes inconsistent Certificate Revocation Lists (CRLs) to be used and might allow remote attackers to bypass intended access restrictions via a revoked certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-04-03T00:00:00.000Z
CVE-2012-4547 
Unspecified vulnerability in awredir.pl in AWStats before 7.1 has unknown impact and attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-31T10:00:00.000Z
CVE-2012-4548 
Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4551 
Use-after-free vulnerability in libunity-webapps before 2.4.1 allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted web site, related to "certain hash tables."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-4552 
Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-18T23:00:00.000Z
CVE-2012-4553 
Drupal 7.x before 7.16 allows remote attackers to obtain sensitive information and possibly re-install Drupal and execute arbitrary PHP code via an external database server, related to "transient conditions."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4554 
The OpenID module in Drupal 7.x before 7.16 allows remote OpenID servers to read arbitrary files via a crafted DOCTYPE declaration in an XRDS file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-11T11:00:00.000Z
CVE-2012-4555 
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2012-4556 
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T22:00:00.000Z
CVE-2012-4557 
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T19:00:00.000Z